Home › Resources › tcpdump

Executive Summary

tcpdump is a free, command-line tool that captures and displays network packets on a system. Because it is small, fast, and available on most Unix-like systems, it is the go-to way to capture traffic on servers where a graphical tool is not practical. It should only be used on interfaces and networks you own or are authorized to inspect.

What It Is

tcpdump is a command-line packet capture and analysis utility built on the libpcap library. It records the packets crossing a chosen network interface and prints a concise, text summary of each one, or writes them to a capture file for later analysis. It supports the Berkeley Packet Filter syntax, a compact and powerful language for selecting exactly which packets to keep, such as traffic to a particular host or port. Because it runs entirely in a terminal and has almost no dependencies, tcpdump is ideal for capturing on remote servers, network devices, and headless systems, and the files it produces open cleanly in graphical analyzers like Wireshark.

Why It Matters

Much troubleshooting comes down to one question: is the traffic actually arriving, and what does it look like? On a server with no desktop, tcpdump is often the fastest way to answer that. It confirms whether requests reach an application, whether responses go back, where a handshake fails, and whether a firewall is silently dropping packets. For defenders, a quick tcpdump can confirm suspicious activity in real time or capture evidence during an incident. Its filter language lets a professional narrow a flood of traffic to the exact conversation that matters, which makes it both efficient and precise. Because captures can contain sensitive data, they must be handled with care.

How It Works

tcpdump puts a network interface into a capture mode and reads each packet as it passes. By default it prints a one-line summary per packet, showing timestamp, addresses, ports, protocol flags, and size, and it can print more or less detail on request. The key to using it well is filtering: a Berkeley Packet Filter expression tells the kernel to hand tcpdump only the packets you care about, which reduces load and noise. A common pattern is to capture on a specific interface, for example tcpdump -i eth0, optionally adding a filter for a host or port and writing the results to a file for deeper analysis elsewhere. Because it captures at a low level, running it usually requires elevated privileges, and on switched networks it sees only the traffic reaching that interface unless a mirror port or tap is used.

Architecture Diagram

Visual Workflow

Common Attacks

• An attacker with access to a host may run tcpdump to sniff unencrypted credentials, so defenders monitor for unexpected capture activity
• Capture files can be exfiltrated and mined for sensitive data, which is why they must be protected
• Passive sniffing is hard to notice on the wire, so encryption in transit is the primary defense
• On a compromised gateway, captured traffic can expose many sessions, reinforcing the need for segmentation
• Defenders use tcpdump the same way to confirm and document malicious traffic during response

Common Mistakes

• Capturing on a host or interface without authorization
• Running an unfiltered capture on a busy interface and generating an unmanageable flood
• Forgetting that a switched network only shows traffic reaching that interface
• Leaving capture files unprotected even though they may hold credentials or personal data
• Truncating packets too aggressively and missing the payload detail needed for analysis

Best Practices

• Only capture on interfaces and networks you own or are authorized to inspect
• Always use a Berkeley Packet Filter expression to limit collection to what you need
• Write to a capture file for anything you plan to analyze in depth
• Capture full packet detail when payloads matter, and limit it when they do not
• Treat capture files as sensitive and encrypt or delete them promptly
• Note the interface, filter, and time window so the capture can be reproduced

Quick Checklist

• Authorization to capture confirmed for the host
• Correct interface selected
• Filter expression scoped to the relevant traffic
• Output written to a file when deeper analysis is needed
• Capture files stored securely with access controlled
• Interface, filter, and time window documented

Recommended Tools

Industry Standards

Career Relevance

tcpdump is a core skill for systems and network administrators, network security engineers, and SOC analysts and incident responders who need to capture traffic on servers and network devices where graphical tools are unavailable. Comfort with the Berkeley Packet Filter syntax and knowing when to hand a capture file to Wireshark are practical expectations for the hands-on roles that AI-Governance-Jobs.com serves.

Interview Questions

• How would you capture only traffic to and from a specific host and port with tcpdump?
• Why is it important to filter a tcpdump capture on a busy interface?
• When would you write to a capture file instead of reading output on screen?
• How does tcpdump relate to Wireshark, and when would you use each?
• Why does capturing usually require elevated privileges, and what are the risks of capture files?

Related Certifications

Further Reading

• tcpdump and libpcap Official Site
• NIST SP 800-61: Computer Security Incident Handling Guide
• SANS Reading Room

FAQ