tcpdump is a command-line packet capture and analysis tool that lets you intercept and examine network traffic in real time or from saved files.
tcpdump solves the problem of inspecting what data is actually moving across a network by capturing packets at the link layer and decoding them into human-readable form. It works by leveraging libpcap to capture raw packets and then dissecting them to display protocol headers, payload content, and metadata. You can filter captures using Berkeley Packet Filter syntax to focus on specific traffic patterns, protocols, or hosts, and save captures to files for later analysis or sharing with other tools.
tcpdump suits anyone who needs to troubleshoot network issues, audit security, or understand protocol behavior on a live system. It is particularly valuable for systems administrators, network engineers, and security professionals who need to see exactly what traffic a machine is sending and receiving. The tool works across different operating systems and integrates with the broader packet analysis ecosystem through its support for standard pcap and pcapng file formats, making captures portable to other analysis tools.
The project maintains a stable, focused codebase written in C that handles the core dissection and filtering logic. Development activity shows consistent attention to compatibility across platforms and packet formats, with ongoing work to support emerging capture formats and maintain the libpcap integration. The maintainers respond to issues and incorporate improvements while preserving backward compatibility with existing scripts and workflows that depend on tcpdump's output format and behavior.
