// what it is
Description
Built on libpcap — every other capture tool wraps the same library. Tiny BPF syntax, rock-solid for headless captures, and writes pcap that Wireshark can open later.
// use cases
What people use it for
- Headless packet capture on production boxes
- Quick on-the-wire debugging
- Forensic capture for later Wireshark dissection
// commands
The commands you'll type
Capture all TLS to file
$ tcpdump -i eth0 -nn -s 0 -w out.pcap 'tcp port 443'Live HTTP host filter
$ tcpdump -i any -A 'tcp port 80 and host target.tld'