If you try to run the command as an unprivileged user, you’ll get an error saying: “You don’t have permission to capture on that device”.

The filter expression defines which packets will be captured.

The command options allow you to control the behavior of the command.

Installing tcpdump on Ubuntu and Debian # sudo apt update & sudo apt install tcpdump Installing tcpdump on CentOS and Fedora # sudo yum install tcpdump Installing tcpdump on Arch Linux # sudo pacman -S tcpdump Capturing Packets with tcpdump # You can easily install tcpdump using the package manager of your distro. If tcpdump is not present on your system, the command above will print “tcpdump: command not found”. The output should look something like this: tcpdump version 4.9.2 To check if the tcpdump command is available on your system type: tcpdump -version Tcpdump is installed by default on most Linux distributions and macOS. In this article, we will cover the basics of how to use the tcpdump command in Linux. One of the most powerful features of the tcpdump command is its ability to use filters and capture only the data you wish to analyze.

The captured packets can be written to a file or standard output.

It is the most commonly used tool among network administrators for troubleshooting network issues and security testing.ĭespite its name, with tcpdump, you can also capture non-TCP traffic such as UDP, ARP, or ICMP. Tcpdump is a command-line utility that you can use to capture and inspect network traffic going to and from your system.

Tcpdump and wireshark