Tcpdump
From Wikipedia, the free encyclopedia
- The correct title of this article is tcpdump. The initial letter is shown capitalized due to technical restrictions.
| tcpdump | |
 tcpdump console output |
|
| Developer: | The Tcpdump team |
|---|---|
| Latest release: | 3.9.5 / September 19, 2006 |
| OS: | Linux, Solaris, FreeBSD, NetBSD, OpenBSD, Mac OS X, additional Unix-like systems, Windows |
| Use: | Packet sniffer |
| License: | BSD license |
| Website: | http://www.tcpdump.org/ |
tcpdump is a common computer network debugging tool that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. It was originally written by Van Jacobson, Craig Leres and Steven McCanne who were, at the time, working in the Lawrence Berkeley Laboratory Network Research Group.
Tcpdump works on most Unix-like platforms: Linux, Solaris, BSD, Mac OS X, HP-UX and AIX among others. In those systems, tcpdump is built upon the libpcap packet capture library.
On Windows, WinDump can be used; it's a port of tcpdump to Windows.
On Unix and most other operating systems, a user must have superuser privileges to use tcpdump due to its use of promiscuous mode.
The user may optionally apply any number of filters to render the output more usable on networks with a high volume of traffic.
[edit] Common uses of tcpdump
- to debug applications one is writing which utilize the network for communications
- to debug the network setup itself, by determining whether all necessary routing is or is not occurring properly, allowing the user to further isolate the source of a problem
- to intercept and display the communications of another user or computer. Some protocols, such as telnet and HTTP, transmit information unencrypted over the network. A user with control of a router or gateway through which other computers' unencrypted traffic passes can use tcpdump to view login IDs, passwords, the URLs and content of websites being viewed, or any other information.
- to stream packets from any machine with tcpdump and SSH to a machine running OmniPeek or EtherPeek with the TCPDump Remote Adapter. The TCPDump Remote Adapter is freely available at http://www.omnipeek.com
[edit] See also
- Ethereal, from which Wireshark is descended
- Packet sniffer
- Snoop, a similar program on Solaris
- Wireshark is a similar program with a GUI frontend, and many additional formatting, sorting, and display facilities.
- OmniPeek is an analyzer that supports streaming of packets from a remote machine running tcpdump.
