tcpdump

tcpdump is a command-line tool for network monitoring and data acquisition, built around the libpcap packet-capture interface. It suits users who want a free capture tool and are comfortable working with system permissions or building software; its main trade-off is that capture access depends on the operating system and its configuration.

Overview

Using libpcap gives tcpdump a system-independent capture interface, while its broad range of supported systems makes it a practical choice across varied environments. It supports PCAP, remote capture, traffic decryption, and both local and remote capture sources. Those capabilities make it useful for collecting network data, but they do not make it a graphical analysis workspace: tcpdump is a CLI tool, best suited to users who are comfortable with command-line workflows.

Installation can mean using a native package or port, or compiling from source. Packages may lag behind the project by a few versions; compiling a newer snapshot is an option for users prepared to manage the build requirements. Capturing traffic also requires appropriate operating-system permissions, and anyone granted capture access may be able to collect sensitive traffic, including passwords.

Key features

• Packet capture through libpcap: A system-independent capture interface supports use across multiple operating systems. This breadth is valuable for monitoring work in mixed environments, though actual capture access still depends on local configuration.
• PCAP and remote capture: Support for PCAP and remote capture sources suits users collecting traffic from different places or working with capture files. The command-line format is a better fit for operators and technical users than readers seeking a graphical analyzer.
• Source builds: The public Git repository provides source code. Building requires libpcap and a C99-compliant compiler, so source installation offers a route to newer snapshots but adds setup work.
• Redistribution rights: The license permits use and redistribution in source and binary form subject to its conditions, making tcpdump suitable for users who need software they can redistribute within those terms.

Pricing

tcpdump is free, with a listed price of $0. There is no free trial because there is no paid plan to try. The free plan is the software itself, under its redistribution and use conditions; there are no paid tiers or plan-based quotas described.

The cost is not the only practical consideration: capture depends on operating-system permissions, and building from source requires libpcap and a C99-compliant compiler. Users who prefer not to compile can look for native packages or ports, though those may be a few versions behind.

Platforms

tcpdump is listed for Linux, macOS, and Windows. The project also names AIX, several BSD systems, Solaris, and QNX among systems where it compiles and works. Native packages or ports are available on many systems.

Windows builds require WinPcap or Npcap, plus Visual Studio with CMake. Across platforms, capture permission depends on the operating system and its configuration, so installation alone does not guarantee that a user can capture traffic.

Who it's for

tcpdump is a strong fit for network operators, developers, and technically capable users who need free packet capture, PCAP support, or a command-line tool that works across a range of systems. Source access and redistribution rights also suit users who need to build or redistribute it under the license conditions.

It is less suitable for someone who wants a graphical interface or does not have the permissions needed to capture traffic. Treat capture access as sensitive: users who can capture traffic may collect passwords as well as other network data.

Pros and cons

• Pro — Broad system support: The project covers Linux, macOS, Windows, and several additional systems, which helps teams use one capture tool across varied environments.
• Pro — Free with source access: There is no license fee, and source builds offer a way to use a newer snapshot when native packages lag.
• Pro — Useful capture capabilities: PCAP support, remote capture, and traffic decryption address a range of data collection needs.
• Con — Command-line interface: Its CLI orientation favors users comfortable with command-line work; users who want a graphical analysis tool should consider other options.
• Con — Permissions and sensitive data: Capture access varies by system configuration and can expose passwords, so it requires careful control.
• Con — Source builds require development tools: Newer snapshots require libpcap and a C99-compliant compiler; Windows builds add WinPcap or Npcap and Visual Studio with CMake.

Alternatives

Pick Termshark if you want a free option across Linux, macOS, Windows, or Android and are prepared to have tshark v1.10.2 or newer in PATH; some tshark features are not exposed.

Malcolm is another free option, with Linux, macOS, Windows, web, API, and self-hosted platforms listed; its plan is self-hosted software under Apache License 2.0.

Consider NetworkMiner if its free edition suits your needs: it is freemium, and its source is managed C# on the Microsoft .NET Framework, released under GPLv2.

Sniffnet is a free, fully open-source option for Linux, macOS, and Windows, under MIT or Apache-2.0.

Choose TShark for another free Linux, macOS, and Windows option from the Wireshark project, maintained by the donation-supported Wireshark Foundation.

Wireshark offers a free full version with no license fee for Linux, macOS, and Windows.

Arkime is a free, open-source option for Linux, API, web, and self-hosted use, with no paid-only features or license fees.

For a Windows-only freemium option, Colasoft Capsa has a free plan limited to monitoring 10 IP addresses, a four-hour session timeout, and no WiFi connection monitoring; its Professional plan is $695, paid once.

Browse more options in Network Packet Capture Software, Network Packet Analyzer Software, and Network Protocol Analyzers.

Verdict

Choose tcpdump if you need free, command-line packet capture across a range of systems and value source access and PCAP support. Its strongest reason to choose it is that breadth without a license fee; its clearest reason to look elsewhere is the CLI workflow, alongside the permissions and security care that capturing sensitive traffic demands.