tcpdump
Command-line packet capture.
KaliParrotLinuxpassive
pkg: tcpdump
tcpdump captures and filters packets on the CLI using BPF expressions — perfect for headless and quick captures.
Syntax
tcpdump -i {iface} [filter] [-w out.pcap]
Example
tcpdump -i eth0 -w cap.pcap "port 53"
Captures DNS (port 53) traffic on eth0 to cap.pcap for later analysis.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
tcpdump
Usage examples
tcpdump -i eth0 -w cap.pcap "port 53"
Capture DNS traffic to a file.
tcpdump -i any -n "host 10.0.0.5 and port 80"
Live HTTP traffic to/from one host.
Advantages
- Lightweight and ubiquitous
- Perfect for servers/SSH
- Writes pcap for Wireshark
Disadvantages
- No graphical dissection
- BPF syntax learning curve
- Needs root/cap_net_raw
Tags
#pcap#cli
Official docs: tcpdump ↗
Related commands
Frequently asked questions
What is tcpdump used for?
tcpdump captures and filters packets on the CLI using BPF expressions — perfect for headless and quick captures.
What is an example tcpdump command?
A common example is: tcpdump -i eth0 -w cap.pcap "port 53" — Captures DNS (port 53) traffic on eth0 to cap.pcap for later analysis.
Is tcpdump part of Kali Linux?
Yes. tcpdump ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install tcpdump.
What category of security tool is tcpdump?
tcpdump is a Sniffing & Spoofing tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.