tcpdump is a free tool for network monitoring and data acquisition. It captures packets using libpcap, a system-independent interface for user-level packet capture, and provides command-line tools and PCAP support. The project lists AIX, several BSD systems, GNU/Linux, macOS, Solaris, QNX, and Windows among systems where it compiles and works. Building it requires libpcap and a C99-compliant compiler; Windows builds also require WinPcap or Npcap and Visual Studio with CMake. The project publishes source code through its public Git repository, and native packages or ports are available on many systems. Its license permits redistribution and use in source and binary forms subject to stated conditions. Whether a user can capture traffic depends on the operating system and its configuration. The project cautions that users with capture permission may be able to capture network traffic, including passwords. Native packages can sometimes be a few versions behind, while a newer snapshot can be compiled from source.
Who it is for
tcpdump suits people who need command-line network monitoring or data acquisition and can work with packet-capture permissions on their system. Building from source requires libpcap and a C99-compliant compiler.
What is good
- Free software with source available through a public Git repository.
- Uses libpcap for packet capture.
- Project lists multiple operating systems, including Windows.
- PCAP support and command-line tools are listed.
What to know first
- Capture permission depends on operating system and configuration.
- Windows builds require additional tools and libraries.
- Native packages may lag behind newer snapshots.
- Permitted capture can include network traffic such as passwords.
Verdict
tcpdump offers free packet capture across a broad set of listed systems, with source builds available. Check capture permissions and handle access carefully because captured traffic may include passwords.
tcpdump plans and pricing
All plansCompared on network packet analyzer software
- Free plan
- Yes
- Traffic decryption
- Yes
