tcpdump
Command-line packet analyzer for capturing network traffic, applying BPF filters, and saving raw PCAP files for analysis.
Technical Architecture & Overview
tcpdump is a ubiquitous command-line packet analyzer that ships on virtually every Unix-like system. It uses libpcap to capture and filter network traffic, making it the reference CLI tool for live packet capture and offline PCAP inspection.
Targeted Technical Use Cases
Quick packet capture on servers, network devices, and containers without a GUI; scripting automated capture workflows.
Evaluation & Trade-offs
Core Strengths
- +Available on virtually every Unix-like system by default, requiring no installation.
- +Powerful BPF filter syntax for precise packet selection at the kernel level.
- +Lightweight and fast, suitable for capture on resource-constrained devices and production servers.
Trade-Offs & Limitations
- -Command-line only; no GUI for interactive packet inspection (use Wireshark for that).
- -Limited protocol dissection compared to Wireshark; focuses on packet headers rather than deep protocol decoding.
Defensive Security Application
Capturing network traffic for forensic analysis on servers and devices where GUI tools are unavailable.
Frequently Asked Questions
What is tcpdump?→
tcpdump is a ubiquitous command-line packet analyzer that ships on virtually every Unix-like system. It uses libpcap to capture and filter network traffic, making it the reference CLI tool for live packet capture and offline PCAP inspection.
What is tcpdump used for?→
Quick packet capture on servers, network devices, and containers without a GUI; scripting automated capture workflows.
What are the strengths of tcpdump?→
- +Available on virtually every Unix-like system by default, requiring no installation.
- +Powerful BPF filter syntax for precise packet selection at the kernel level.
- +Lightweight and fast, suitable for capture on resource-constrained devices and production servers.
What are the limitations of tcpdump?→
- +Command-line only; no GUI for interactive packet inspection (use Wireshark for that).
- +Limited protocol dissection compared to Wireshark; focuses on packet headers rather than deep protocol decoding.
How is tcpdump used defensively?→
Capturing network traffic for forensic analysis on servers and devices where GUI tools are unavailable.