D.3. tcpdump: Capturing with “tcpdump” for viewing with Wireshark
Prev | Appendix D. Related command line tools | Next

## D.3. tcpdump: Capturing with “tcpdump” for viewing with Wireshark

It’s often more useful to capture packets using `tcpdump` rather than `wireshark`. For example, you might want to do a remote capture and either don’t have GUI access or don’t have Wireshark installed on the remote machine.

Older versions of `tcpdump` truncate packets to 68 or 96 bytes. If this is the case, use `-s` to capture full-sized packets:

    $ tcpdump -i <interface> -s 65535 -w <some-file>

You will have to specify the correct interface and the name of a file to save into. In addition, you will have to terminate the capture with ^C when you believe you have captured enough packets.

`tcpdump` is not part of the Wireshark distribution. You can get it from http://www.tcpdump.org/ or as a standard package in most Linux distributions. For more information on `tcpdump` consult your local manual page (`man tcpdump`) or the online version.

Prev | Up | Next
D.2. tshark: Terminal-based Wireshark | Home | D.4. dumpcap: Capturing with “dumpcap” for viewing with Wireshark