Tcpdump
network analysis
A powerful command-line packet analyzer. Print a description of the contents of packets on a network interface that match boolean expressions.
packet captureCLInetwork debugging
Legal & Ethical Use
- Network debugging
- Authorized traffic monitoring
- Security analysis
- Scripted packet capture
Installation
bash
$
sudo apt install tcpdumpBasic Commands
bash
$
tcpdump -i eth0Capture on specific interface
bash
$
tcpdump -w capture.pcapWrite to file
bash
$
tcpdump port 80Filter by port
bash
$
tcpdump -n host 192.168.1.1Filter by host
Advantages
- Lightweight
- Scriptable
- Pre-installed on most systems
- Low overhead
Limitations
- CLI only
- Output can be verbose
- Needs root access