tcpdump is a command-line tool specifically designed for packet capture. tcpdump is often included with Linux distributions and is found on many network devices. For many of these devices, tcpdump has to be run as a root user or with root privileges as it will be monitoring the network traffic. The full page is available at

To access the basic help menu, type the following into the Command Prompt:

 caine@caine:~$ tcpdump -h

The command will produce the basic options available for tcpdump:

The default setting of Tcpdump is to capture traffic on all available interfaces. Running the following command produces ...

Get Digital Forensics and Incident Response now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.