tcpdump

CautionCapture packets

tcpdump -i <iface> port <n>

The ultimate truth: watch packets live. -w saves pcap for Wireshark. Always filter the capture.

Examples

tcpdump -i eth0 host 10.0.0.5 and port 443 -w cap.pcapCapture one conversation

Syntax

tcpdump [-i iface] [-w file] [filter]

Before you run it

Captures sensitive data; mind the load.

Related commands

ssSockets and listening ports
ncPort checks & raw sockets
diagnose sniffer packetPacket sniff

The same reference, with no signal at all

Every command on this site, held on your device. The app adds 632 more: 1,510 commands and 120 fix flows, searchable with no connection. Free to install, no ads (some content is a one-time purchase).

Get it free on the App Store