Capturing and Inspecting Traffic with tcpdump

Diagnostics like ping and dig tell you whether something works, but sometimes you need to see the actual packets. tcpdump captures network traffic in real time.

First find which interface to listen on with -D. Common names are eth0, wlan0, or en0.

-i selects the interface. Capturing requires root because it reads raw packets.

-c stops after N packets so the terminal does not flood, useful for a quick look.

Capture filters narrow the noise. host limits to traffic to/from one address.

Use port to focus on a service. Here we watch only HTTPS traffic.

Filters combine with and, or, not for precise targeting.

-n skips DNS lookups (faster, shows IPs), and -v adds detail. -A prints packet payloads as ASCII.

-w writes raw packets to a .pcap file you can analyze later, e.g. in Wireshark.

-r replays a saved capture, and you can still apply filters while reading.

tcpdump helps spot unexpected outbound connections, confirm a firewall rule is blocking traffic, or verify that sensitive data is encrypted on the wire.

What does the -w option do in tcpdump?

You can now inspect live traffic:

• -i picks the interface, -c limits count
• Filters: host, port, combined with and/or/not
• -n/-v/-A shape output
• -w saves and -r reads .pcap files

tcpdump turns invisible packets into a debuggable stream.