tcpdump
CautionCapture packets
tcpdump -i <iface> port <n>
The ultimate truth: watch packets live. -w saves pcap for Wireshark. Always filter the capture.
Examples
tcpdump -i eth0 host 10.0.0.5 and port 443 -w cap.pcapCapture one conversation
Syntax
tcpdump [-i iface] [-w file] [filter]
Before you run it
Captures sensitive data; mind the load.
Related commands
- ssSockets and listening ports
- ncPort checks & raw sockets
- diagnose sniffer packetPacket sniff
The same reference, with no signal at all
Every command and flow from this site, held on your device and searchable with no connection. Free to install, no ads.
Get it free on the App Store