01 · Product name
tcpdump
Print packets from a file or an interface.
Published by The Tcpdump Group.
In short
tcpdump is the command-line packet printer from The Tcpdump Group, built on libpcap. The project site on 18 Oct 2026 listed stable tcpdump 4.99.7, dated 2026-09-21, and testing libpcap 1.11.0, dated 2026-09-13. The binary on this host printed tcpdump version 4.99.4. The repository LICENSE file begins License: BSD. The GitHub SPDX field is NOASSERTION. A full read of the sample http2_follow_multistream.pcapng printed 197 packets. The first lines were a TCP handshake to 104.16.40.2 port 443, and they did not print the TLS server name.
Product pricing strategy
02
Free
tcpdump.org does not print a price for the stable release. The LICENSE file says BSD. There is no seat and no credit on that page. The 4.99.4 binary was the distribution package. It is not a paid build. libpcap's testing release notes mention a fellowship that funded maintainer time. That is not a fee you pay to run the tool. If a vendor sells a sensor that happens to include tcpdump, cite the sensor. Cite tcpdump.org for the version labels and the LICENSE file for the grant.
Utility and features
03
tcpdump writes or reads pcap and prints a one-line summary per packet. The home page separates the testing libpcap 1.11.0 release of 13 September 2026 from the stable tcpdump 4.99.7 release of 21 September 2026, and it also lists stable libpcap 1.10.7 from 5 September 2026. Those dates and numbers are the page's. The Ubuntu binary used here was 4.99.4, older than that stable label. The LICENSE file in the-tcpdump-group/tcpdump says License: BSD. The GitHub API does not give an SPDX id. Quote the file's heading, not a guessed SPDX.
- 4.99.4 ran, 4.99.7 is stable upstream. The binary printed 4.99.4. The site listed stable tcpdump 4.99.7 on 2026-09-21.
- 197 packets. A full read of the sample produced 197 lines. The file is Wireshark's http2 follow capture.
- LICENSE says BSD. The repository file begins License: BSD. The GitHub SPDX field is NOASSERTION.
On http2_follow_multistream.pcapng, tcpdump -n -c 4 showed the start of the capture, and a count of the full read was 197 lines. A filter for tcp port 443 printed the handshake toward port 443. The addresses are the sample's. tcpdump's line is shorter than TShark's dissection of the same file: this run did not print the TLS server name, and TShark did. Use tcpdump to capture or to confirm packets exist. Use TShark or Wireshark when you need the server name decoded. Do not capture a network you are not allowed to watch. This listing read a file.
- 1
Print the version, then read the file with -n so names are not looked up.
- 2
Add a filter only after the unfiltered count is in the note.
- 3
Move to TShark when you need a handshake field tcpdump did not print.
Caveats
04
Version 4.99.4 ran. Version 4.99.7 is the site's stable label from 21 September 2026. They are different builds. The first lines of a count and a port-443 filter are easy to misread as two different files. Both were the Mozilla sample, 197 packets.
A one-line TCP summary does not include the TLS SNI unless the build and the flags decode it. This 4.99.4 run's short lines did not name www.mozilla.org. Do not copy TShark's server name into a tcpdump caption. The sample's IP addresses are not this host. Reading a file you were given is not permission to capture someone else's network.
Screenshots
05
Potential use cases
06
- You need to know the file has packets before you open a GUI. On 18 Oct 2026 tcpdump 4.99.4 read http2_follow_multistream.pcapng and a full pass printed 197 lines. The first lines were a TCP handshake from 10.9.0.2 port 59246 to 104.16.40.2 port 443. Use -n so the tool does not look up names. The project site's stable label that day was 4.99.7.
- A note copies www.mozilla.org into the tcpdump result. This 4.99.4 run's short lines did not print that server name. TShark's field extraction on the same file did. Quote the tool that printed the field. A port-443 filter and an unfiltered count were the same sample, not two captures.
- The license line is about to be guessed. The repository LICENSE file begins License: BSD. The GitHub SPDX field is NOASSERTION. Quote the file. tcpdump.org did not print a price. The testing libpcap 1.11.0 line dated 2026-09-13 is a different release from stable tcpdump 4.99.7 dated 2026-09-21.
Hard cases
The case where the first result is easy to over-read.
A short line is given TShark's field
tcpdump 4.99.4 printed the handshake to port 443 and did not print the TLS server name. Do not paste www.mozilla.org into that caption. If the note needs the name, cite the TShark extraction or the Wireshark packet bytes. Keep 4.99.4 as the binary and 4.99.7 as the site's stable label.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
i finally figured out that tcpdump is amazing. here's some of what I learned: https://t.co/OxqKocS3p3
Turned out: - The cable was actually a Thunderbolt cable so it had automatically set up a Thunderbolt Bridge network interface. (Is there a pure-USB equivalent? I think there is.) - tcpdump showed that sharingd was sending lots of data over that interface.
NX-OS on-box tip: Packet capture & save. Run bash sudo tcpdump -i eth0 -w arp_capture.pcap arp Replace <eth0> with the interface you want to capture ARP packets from (e.g eth1/32), and <arp_capture.pcap> with the name of the file where you want to save the captured packets.
DNS timeouts in Kubernetes are frustrating to debug because the root cause can be far from where the symptoms appear. In the example below, the CI system fails with "could not resolve hostname" errors traced back to a 1024 packets-per-second limit on AWS link-local addresses, and…
So it turned out to be much simpler: - blacklist module - iptables -j DROP on -i, -o $IFACE - modprobe module - tcpdump -i $IFACE - iptables -F BUT this thread gave me a lot of great ideas and I want to check PF_RING &&|| two ifaces with same mac. Thanks! You all rock 💪🤘🔥❤️ https://t.co/5b6n0CgOdi
Questions
Is tcpdump free?
The project site does not print a price. The LICENSE file says BSD. The binary this listing ran was tcpdump 4.99.4.
Did tcpdump print the TLS server name?
Not in the 4.99.4 lines captured here. TShark's field extraction on the same file printed www.mozilla.org. Quote the tool that printed the field.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
tcpdump project site
https://www.tcpdump.org/Documentation
tcpdump repository
https://github.com/the-tcpdump-group/tcpdump