Tcpdump

Tcpdump is the quintessential, industry-standard command-line network packet analyzer and packet capture utility used by network engineers, security analysts, and systems administrators to inspect, capture, and troubleshoot network traffic on Unix and Linux systems. Operating via the libpcap library, Tcpdump intercepts and captures raw packets directly from network interface cards in real time, displaying protocol headers and packet payloads directly in the terminal or writing full packet streams to standardized PCAP files for forensic analysis in tools like Wireshark. The utility features an expressive packet filtering syntax—Berkeley Packet Filter (BPF)—that allows operators to isolate specific network traffic with extreme precision, filtering by IP address, subnet, TCP/UDP port, protocol type (such as ICMP, ARP, or DNS), TCP control flags (SYN, ACK, RST), and packet payload offsets. Tcpdump is indispensable for diagnosing network configuration errors, identifying routing anomalies, troubleshooting DNS failures, detecting rogue network traffic, and capturing forensic evidence during active cyber incident response investigations. Available natively across virtually all Linux distributions, BSD systems, and macOS, Tcpdump provides an essential, lightweight, and versatile foundation for network protocol analysis.