tcpdump

Watching the wire directly

tcpdump captures and displays packets in real time. It's the terminal-based packet sniffer. Where the rest of the tools tell you outcomes (host responded, port open), tcpdump shows you the actual bytes flowing — which is essential when something looks fine at every higher level but still doesn't work.

Filter expressions are everything

tcpdump uses BPF (Berkeley Packet Filter) syntax for filtering. Examples: port 22, host 192.168.1.100, tcp and port 443, not port 22. Without a filter, you'll drown in noise. Always filter.

For deeper analysis, save to pcap and use Wireshark

tcpdump's text output is good for live triage. For real packet analysis ("why is this TLS handshake failing?"), capture to a pcap file and open it in Wireshark. tcpdump captures, Wireshark analyzes — they're a team.

Code

tcpdump recipes·bash

# Live capture on en0, port 22 traffic, no DNS, brief
sudo tcpdump -i en0 -nn port 22

# All traffic to/from a specific host
sudo tcpdump -i en0 -nn host 192.168.1.100

# Save to a pcap file for Wireshark
sudo tcpdump -i en0 -w capture.pcap
# Stop with Ctrl+C, then open capture.pcap in Wireshark

# DNS queries on the wire
sudo tcpdump -i en0 -nn port 53

# ASCII printable form (good for plaintext protocols, useless for TLS)
sudo tcpdump -i en0 -A port 80

# Limit to N packets and exit
sudo tcpdump -i en0 -c 100 -nn port 22

Exercise

Pick a service you can trigger (open a webpage, run an SSH command). In another terminal, run sudo tcpdump -i en0 -nn -c 30 host that-host. Trigger the activity, watch the packets fly. You'll see the TCP handshake (SYN/SYN-ACK/ACK), some encrypted data, and the FIN/ACK shutdown. Now you've seen the wire directly.