tcpdump captures network packets from a Linux terminal; Wireshark lets you inspect those packets interactively in a graphical interface. A practical workflow is to capture authorized traffic with tcpdump, save it as a pcap file, then open that file in Wireshark for detailed analysis. This is especially useful when the Linux machine is remote or has no desktop environment.
What tcpdump and Wireshark do
Both tools help you observe and analyze network traffic, but they serve different parts of the job. The Linux Foundation’s lesson on these tools, published on 21 February 2017, describes them as passive: they listen to traffic exposed to the system by the network infrastructure rather than generating or changing that traffic. What a machine can observe depends on its network position and configuration.
As an Amazon Associate I earn from qualifying purchases.
tcpdump: capture from the command line
tcpdump is a terminal-based packet capture tool commonly available through Linux distributions. It can print matching packets as they arrive or write them to a capture file for later inspection. It uses libpcap-style capture filters to decide which traffic to collect.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWireshark: inspect packets interactively
Wireshark provides a graphical environment for examining live traffic or saved captures. Its packet list, protocol details and hexadecimal views make it easier to explore what is inside packets than a stream of terminal output. It can also reassemble TCP conversations. The Wireshark manual describes it as a tool that lets users “interactively browse packet data from a live network or from a previously saved capture file.”
#1 Best Overall
tcpdump vs. Wireshark
| Aspect | tcpdump | Wireshark |
|---|---|---|
| Interface | Command line | Graphical, interactive interface |
| Main role | Capture traffic efficiently, with optional live text output | Decode and inspect packet data in depth |
| Where it fits | Remote or headless Linux hosts, as well as desktop systems | A workstation with a graphical desktop; it can also capture live traffic where configured |
| Filtering | Capture filters in libpcap/tcpdump syntax, applied during capture | Display filters in Wireshark syntax, applied to packets already available in the capture |
| Typical output | Readable packet summaries in the terminal or a saved capture file | Packet summaries, decoded protocol details, hexadecimal data, search, coloring and statistics |
They are complementary rather than competing tools: tcpdump is convenient for collecting traffic on the Linux host, while Wireshark is often more convenient for investigating the resulting packets.
Capture traffic with tcpdump and open it in Wireshark
Only capture traffic on systems and networks you own or are authorized to monitor. Captures can contain sensitive information, so handle and store them accordingly.
-
Choose the network interface. Identify the interface that can see the traffic you need. The example below uses
any, which asks tcpdump to capture across available interfaces, but a specific interface may be more appropriate for a focused capture.The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Capture matching traffic to a file. The Linux Foundation lesson demonstrates HTTP traffic on port 80 with this command:
sudo tcpdump -i any port 80 -w http-dump.pcapHere,
-i anyselects the capture interface scope,port 80is the capture filter, and-w http-dump.pcapwrites the packets to a file rather than printing the packet summaries as the main output. The command usessudobecause live capture may require elevated privileges; the exact permission setup varies by Linux distribution and system configuration. -
Stop the capture when you have enough data. The capture should be limited to the traffic and time needed for the investigation. A filter such as
port 80narrows what is collected, but it does not make the contents of the capture inherently safe to share. -
Open the capture in Wireshark. Transfer the file to a machine with Wireshark if necessary, then open
http-dump.pcapin Wireshark. Wireshark supports both pcap and pcapng capture formats, including files produced by tcpdump.Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Inspect the packets. Use the packet list to find relevant traffic, select a packet to inspect its decoded protocol fields and raw bytes, and follow TCP conversations when you need to see how packets relate to one another.
The same lesson also shows live terminal observation with sudo tcpdump -i any port 80. In either form, a filter for port 80 selects traffic associated with that port; it does not establish that the traffic is encrypted or that its application content is safe to disclose.
Capture filters and display filters are different
A capture filter is applied as packets are collected. It reduces the data written or presented by the capture process, and it cannot be changed mid-capture. A display filter is applied in Wireshark after packets are available; it hides nonmatching packets from the current view and can be changed interactively.
| Filter type | Example for port 80 | When it acts | Effect |
|---|---|---|---|
| Capture filter | tcp port 80 |
During capture | Limits which packets are collected |
| Display filter | tcp.port == 80 |
After capture, in Wireshark | Focuses the visible packet list without changing the saved capture |
As Wireshark’s capture-filter reference stresses, capture filters such as tcp port 80 are not the same syntax as display filters such as tcp.port == 80. Use the former when you need to limit collection; use the latter when you want to investigate or narrow a capture interactively.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhere each tool fits in a Linux security workflow
- Use tcpdump on a remote or headless host when you need to collect traffic without installing or operating a graphical interface there.
- Use Wireshark on a workstation when packet decoding, protocol fields, conversation reassembly and interactive filtering will help answer the question.
- Use both together when capture access is available on a server but detailed inspection is easier elsewhere: collect a focused file with tcpdump, then analyze that file in Wireshark.
Wireshark’s User’s Guide documents installation through distribution packages, capture privileges and interface selection. The right setup depends on the Linux distribution and permissions in place; if live capture is unavailable in Wireshark, a tcpdump capture followed by file analysis is a practical alternative.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
