tcpdump
The no-frills, run-anywhere way to see exactly what's on the wire
What it is
About tcpdump
tcpdump is a free, open-source command-line packet analyser for Unix-like systems, used by network engineers and security analysts to capture and inspect raw network traffic. It captures live network packets straight from a network interface and prints or saves them for analysis, using the same underlying libpcap library as Wireshark but from the command line.
What you can do with it
Capabilities
Capture live traffic on a specific network interface
Filter captures by host, port, protocol or custom BPF expressions
Save captured traffic to a .pcap file for later analysis in Wireshark
Diagnose connectivity issues (dropped packets, retransmissions, DNS failures) on servers
Monitor traffic on remote/headless Linux systems over SSH
How to learn it
Learning Resources
The official tcpdump man page and tcpdump.org documentation
Practical Packet Analysis (book) for applied filter-writing and troubleshooting technique
Interactive practice on a home lab or virtual machine capturing your own traffic
Cross-reference with Wireshark's display filter syntax, since BPF filter logic underlies both tools
Pro Tip
Write a specific capture filter (e.g. `tcpdump -i eth0 port 443 and host 10.0.0.5`) rather than capturing everything — narrow captures are far easier to read and don't fill disk on a busy server
Skills that use this tool
Roles that use this tool