tcpdump
More info
- Released
- Type
- Packet analyser
- License
- BSD-3-Clause
- Website
- tcpdump.org
The command-line packet sniffer — the thing that actually shows what is on the wire once every other theory has run out.
Dates from 1988, built on libpcap, which in turn became the foundation for Wireshark and a hundred other tools. Filters use BPF syntax: tcpdump -i eth0 'tcp port 443 and host 10.0.0.5'.
-w file.pcap saves for later analysis in Wireshark, which is the standard workflow — capture on the server, analyse on the desktop. Present everywhere, including minimal container images, and usually the first thing reached for at "but the firewall should be allowing this".