tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.

How does tcpdump work in Linux?

Tcpdump uses libpcap library to capture the network packets & is available on almost all Linux/Unix flavors. Tcpdump command can read the contents from a network interface or from a previously created packet file or we can also write the packets to a file to be used for later.

What is the tcpdump used for?

tcpdump is a packet analyzer that is launched from the command line. It can be used to analyze network traffic by intercepting and displaying packets that are being created or received by the computer it’s running on.