# Install tcpdump with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper Command-line packet analyzer. Version 4.99.6 via Homebrew; verified 2026-06-22. ## Install ```sh sudo av install brew:tcpdump ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install tcpdump ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install tcpdump ``` Evidence: MacPorts ports tree: net/tcpdump/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add tcpdump ``` Evidence: Alpine Linux edge package indexes: tcpdump from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install tcpdump ``` Evidence: Debian stable package indexes: tcpdump from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install tcpdump ``` Evidence: Fedora Rawhide package metadata: tcpdump from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#tcpdump ``` Evidence: nixpkgs package indexes: pkgs/by-name/tc/tcpdump/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S tcpdump ``` Evidence: Arch Linux sync databases: tcpdump from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install tcpdump ``` Evidence: openSUSE Tumbleweed package metadata: tcpdump from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:tcpdump - **Package manager:** Homebrew - **Package manager page:** - **Version:** 4.99.6 - **Source summary:** Command-line packet analyzer - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-3-Clause - **Source archive:** - **Last updated:** 2026-06-22T14:06:26-07:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - tcpdump (cli) - tcpdump.4.99.6 (cli) - tcpdump (alias) - tcpdump.4.99.6 (alias) ## Dependencies - libpcap - openssl@4 ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 4.99.6 - Package-manager updated: 2026-06-22 - Local data: ok - Upstream repository: https://www.tcpdump.org/ - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage tcpdump is the classic command-line packet analyzer for capturing, filtering, and decoding network traffic, closely tied to libpcap and Unix network troubleshooting culture. ### Project history The tcpdump source says the program was first written in 1987 by Van Jacobson at Lawrence Berkeley Laboratory. The official README says it was part of research into TCP and Internet gateway performance and was loosely based on Sun's etherfind, with proprietary remnants later rewritten by Steven McCanne. The current project is maintained by The Tcpdump Group. Its GitHub README describes tcpdump as source code for network monitoring and data acquisition and credits continuing improvements to Internet community contributions. ### Adoption history tcpdump became a standard Unix and Unix-like diagnostic tool because it combined packet capture, protocol decoding, and Berkeley Packet Filter expressions in a command-line workflow. The upstream README notes that many operating systems ship tcpdump as a native package or port, which matches its presence across package managers and base-system environments. ### How it is used Typical use is interactive or scripted packet capture: selecting an interface, applying a capture filter, printing decoded packets, or writing pcap files for later inspection. The README points to tcpslice for processing tcpdump capture files and to libpcap as the capture interface dependency, which explains why tcpdump is often packaged alongside libpcap. ### Why package nerds care tcpdump is one of the canonical networking CLIs that package maintainers expect to exist everywhere. Its packaging touches privilege handling, capture library compatibility, platform packet APIs, and manpage fidelity. For package nerds, it is also part of a toolkit lineage: libpcap provides the capture layer, tcpdump provides the terminal interface, and Wireshark and many other tools consume the same pcap ecosystem. ### Timeline - 1987: tcpdump first written by Van Jacobson at Lawrence Berkeley Laboratory. - 1988-2000: Source copyright headers record continuing University of California/LBL-era development. - 1990s: Original LBL README documents research workflows using tcpdump traces and awk summaries. - Modern era: The Tcpdump Group maintains tcpdump with community contributions and GitHub-based development. ### Related projects - libpcap is tcpdump's packet capture library dependency. - tcpslice is maintained by The Tcpdump Group for extracting portions of tcpdump binary trace files. - Wireshark is a related packet-analysis tool, but tcpdump remains the compact CLI-oriented analyzer. ### Sources - - - ## Security Notes doc example: packet capture tool. - **Geiger risk:** red / high - doc example: packet capture tool ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tcpdump - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - tcpdump - 4.99.5-2: normalized package name match | Debian stable package indexes: tcpdump from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | command-line network traffic analyzer | https://www.tcpdump.org/ - Nix - tcpdump: normalized package name match | nixpkgs package indexes: pkgs/by-name/tc/tcpdump/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - tcpdump - 4.99.4-3ubuntu4: normalized package name match | Ubuntu 24.04 LTS package indexes: tcpdump from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | command-line network traffic analyzer | https://www.tcpdump.org/ - apk - tcpdump - 4.99.6-r1: normalized package name match | Alpine Linux edge package indexes: tcpdump from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Command-line packet analyzer | https://www.tcpdump.org/ - apk - tcpdump-doc - 4.99.6-r1: normalized package name match | Alpine Linux edge package indexes: tcpdump-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Command-line packet analyzer (documentation) | https://www.tcpdump.org/ - dnf - tcpdump - 4.99.6-3.fc45: normalized package name match | Fedora Rawhide package metadata: tcpdump from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | A network traffic monitoring tool | http://www.tcpdump.org - pacman - tcpdump - 4.99.6-1: normalized package name match | Arch Linux sync databases: tcpdump from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Powerful command-line packet analyzer | https://www.tcpdump.org/ - zypper - tcpdump - 4.99.6-1.3: normalized package name match | openSUSE Tumbleweed package metadata: tcpdump from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A Packet Sniffer | https://www.tcpdump.org/ - MacPorts - tcpdump: normalized package name match | MacPorts ports tree: net/tcpdump/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [libpcap](https://www.automicvault.com/pkg/brew/libpcap/) - Runtime dependency declared by Homebrew. - [openssl@4](https://www.automicvault.com/pkg/brew/openssl-4/) - Runtime dependency declared by Homebrew. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis, pcap. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, packet-analysis, packet-capture, pcap. - [ipsumdump](https://www.automicvault.com/pkg/brew/ipsumdump/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [ngrep](https://www.automicvault.com/pkg/brew/ngrep/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis. - [packetq](https://www.automicvault.com/pkg/brew/packetq/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [sngrep](https://www.automicvault.com/pkg/brew/sngrep/) - Shares av.db curated category or tags: cli, networking, packet-analysis, packet-capture, pcap. - [daemonlogger](https://www.automicvault.com/pkg/brew/daemonlogger/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-capture, pcap. - [httpry](https://www.automicvault.com/pkg/brew/httpry/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-analysis. ## Combined YAML source View the package source record on GitHub. [combined/tcpdump.yml](https://github.com/automic-vault/db/blob/main/combined/tcpdump.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph