tcpdump
tcpdump captures and prints network packets from the command line, with a powerful filter language.
Legal & ethical use. Capture only traffic you are authorised to inspect; packet captures can contain passwords and personal data. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Capture traffic on a server to debug a connection problem
- Save a pcap on a remote host and analyse it later in Wireshark
Key features
- BPF capture filters
- Write/read pcap files
- Lightweight and scriptable
Installation
Preinstalled or available on most Unix-like systems (for example `sudo apt install tcpdump`).
Beginner usage guide
Capture only what you need with a filter, write it to a file (-w) and open that file in Wireshark for detailed analysis.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Capture HTTP traffic on a lab interface to a file
sudo tcpdump -i eth0 -w web.pcap tcp port 80-i selects the interface, -w writes a pcap, and the filter keeps only TCP port 80.
Keep learning
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary tcpdump (tcpdump version 4.99.6) on 2026-10-27.