Back to tools
What is Tcpdump?
Tcpdump is a command-line tool for capturing and analyzing network packets in real-time. It is essential for network diagnostics and security auditing.
- -i: Specify network interface (any, eth0, wlan0)
- -v, -vv, -vvv: Increase verbosity
- -c: Number of packets to capture
- -w: Save capture to .pcap file
- -s: Snap length (bytes to capture per packet)
- Filters: host, port, tcp, udp, icmp, tcp-flags
Frequently Asked Questions
What is tcpdump and what is it used for?
Tcpdump is a command-line tool for capturing and analyzing network packets in real time. It is essential for diagnosing connectivity issues, auditing suspicious traffic, debugging network protocols, and analyzing performance. It runs on most Unix/Linux systems and captures traffic directly from the network interface.
How do I capture network traffic with tcpdump?
Use tcpdump -i eth0 to capture all traffic on an interface. For more specific captures, add filters: tcpdump -i eth0 host 192.168.1.1 captures traffic to/from that IP; tcpdump -i eth0 port 80 captures HTTP traffic; tcpdump -i eth0 icmp captures only pings. The tool generates these commands automatically based on your filter selections.
What are the most common tcpdump filters?
The most used filters include: host (specific IP), port (TCP/UDP port), tcp/udp/icmp (protocol), src/srcnet (source), dst/dstnet (destination), and combinations with and/or/not. Examples: host 10.0.0.1 and port 443 captures HTTPS traffic to a server; not arp excludes ARP traffic to reduce noise.
How do I save a tcpdump capture to a file?
Use the -w option followed by a filename: tcpdump -i eth0 -w capture.pcap. This saves the capture in binary .pcap format readable by Wireshark. To read it later use tcpdump -r capture.pcap. Combine it with -c N to limit packets: tcpdump -i eth0 -c 1000 -w capture.pcap saves only 1000 packets.