Install tcpdump with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• tcpdump
• tcpdump.4.99.6

Project history

The tcpdump source says the program was first written in 1987 by Van Jacobson at Lawrence Berkeley Laboratory. The official README says it was part of research into TCP and Internet gateway performance and was loosely based on Sun's etherfind, with proprietary remnants later rewritten by Steven McCanne.

The current project is maintained by The Tcpdump Group. Its GitHub README describes tcpdump as source code for network monitoring and data acquisition and credits continuing improvements to Internet community contributions.

Adoption history

tcpdump became a standard Unix and Unix-like diagnostic tool because it combined packet capture, protocol decoding, and Berkeley Packet Filter expressions in a command-line workflow.

The upstream README notes that many operating systems ship tcpdump as a native package or port, which matches its presence across package managers and base-system environments.

How it is used

Typical use is interactive or scripted packet capture: selecting an interface, applying a capture filter, printing decoded packets, or writing pcap files for later inspection.

The README points to tcpslice for processing tcpdump capture files and to libpcap as the capture interface dependency, which explains why tcpdump is often packaged alongside libpcap.

Why package nerds care

tcpdump is one of the canonical networking CLIs that package maintainers expect to exist everywhere. Its packaging touches privilege handling, capture library compatibility, platform packet APIs, and manpage fidelity.

For package nerds, it is also part of a toolkit lineage: libpcap provides the capture layer, tcpdump provides the terminal interface, and Wireshark and many other tools consume the same pcap ecosystem.

Timeline

• 1987: tcpdump first written by Van Jacobson at Lawrence Berkeley Laboratory.
• 1988-2000: Source copyright headers record continuing University of California/LBL-era development.
• 1990s: Original LBL README documents research workflows using tcpdump traces and awk summaries.
• Modern era: The Tcpdump Group maintains tcpdump with community contributions and GitHub-based development.

Related projects

• libpcap is tcpdump's packet capture library dependency.
• tcpslice is maintained by The Tcpdump Group for extracting portions of tcpdump binary trace files.
• Wireshark is a related packet-analysis tool, but tcpdump remains the compact CLI-oriented analyzer.

Sources

• https://github.com/the-tcpdump-group/tcpdump#readme
• https://github.com/the-tcpdump-group/tcpdump/blob/master/tcpdump.c
• https://www.tcpdump.org/manpages/tcpdump.1.html