tcpdump and libpcap

libpcap is a C library that opens a network interface, applies a capture filter inside the kernel and hands matching packets to a program. tcpdump is the command line program that uses it to print packets as text or write them to a file. Both come from The Tcpdump Group under the three-clause BSD licence. The pcap file that libpcap writes is the common currency of network forensics. Wireshark, NetworkMiner, Zeek, Arkime and most commercial sensors read it. At the time of checking the stable releases were tcpdump 4.99.7 and libpcap 1.10.7, both from September 2026, with libpcap 1.11.0 in testing. The group's own release notes list FreeBSD, illumos, Linux, macOS, NetBSD, OpenBSD, QNX, Solaris 11 and GNU/Hurd. Windows is not on that list.

During an incident tcpdump is often the only capture tool present on a Linux server or jump host. The responder chooses the interface, sets the snapshot length so whole packets are kept, writes a Berkeley Packet Filter expression to limit the capture to the hosts or ports of interest, turns off name resolution so the capture itself does not generate DNS traffic and writes to a file, rotating files by size or time for a long capture. The file is then read in Wireshark or another tool. Because tcpdump runs on the host being examined, running it changes that host, so the command used, the time and the account must go into the notes.