tcpdump
Command-line packet analyzer for capturing network traffic, applying BPF filters, and saving raw PCAP files for analysis.
Technical Architecture & Overview
tcpdump is a widely available command-line packet analyzer for Unix-like systems, with Windows builds that use Npcap or WinPcap. It uses libpcap to capture and filter network traffic, for live packet capture and offline PCAP inspection.
Targeted Technical Use Cases
Quick packet capture on servers and devices without a GUI; scripting automated capture workflows.
Evaluation & Trade-offs
Core Strengths
- +Builds on Unix-like systems through libpcap and on Windows with Npcap or WinPcap.
- +Filter expressions in pcap-filter syntax compile to BPF programs for precise packet selection.
- +Writes raw packets to a file with -w instead of parsing them, for later reading with -r or other PCAP tools.
Trade-Offs & Limitations
- -Command-line only; no GUI for interactive packet inspection (use Wireshark for that).
- -Packets can be dropped when the capture buffer runs out of space; tcpdump reports the drop count.
Defensive Security Application
Capturing network traffic for forensic analysis on servers and devices where GUI tools are unavailable.
Frequently Asked Questions
What is tcpdump?→
tcpdump is a widely available command-line packet analyzer for Unix-like systems, with Windows builds that use Npcap or WinPcap. It uses libpcap to capture and filter network traffic, for live packet capture and offline PCAP inspection.
What is tcpdump used for?→
Quick packet capture on servers and devices without a GUI; scripting automated capture workflows.
What are the strengths of tcpdump?→
- +Builds on Unix-like systems through libpcap and on Windows with Npcap or WinPcap.
- +Filter expressions in pcap-filter syntax compile to BPF programs for precise packet selection.
- +Writes raw packets to a file with -w instead of parsing them, for later reading with -r or other PCAP tools.
What are the limitations of tcpdump?→
- +Command-line only; no GUI for interactive packet inspection (use Wireshark for that).
- +Packets can be dropped when the capture buffer runs out of space; tcpdump reports the drop count.
How is tcpdump used defensively?→
Capturing network traffic for forensic analysis on servers and devices where GUI tools are unavailable.