Editing Tcpdump (section)

==Common uses==
tcpdump prints the contents of network packets. It can read packets from a network interface card or from a previously created saved packet file. tcpdump can write packets to standard output or a file.

It is also possible to use tcpdump for the specific purpose of intercepting and displaying the communications of another user or computer. A user with the necessary privileges on a system acting as a [[router (computing)|router]] or [[Gateway (computer networking)|gateway]] through which unencrypted traffic such as [[Telnet]] or [[HTTP]] passes can use tcpdump to view login IDs, passwords, the [[Uniform Resource Locator|URL]]s and content of websites being viewed, or any other unencrypted information.

The user may optionally apply a [[Berkeley Packet Filter|BPF]]-based filter to limit the number of packets seen by tcpdump; this renders the output more usable on networks with a high volume of traffic.

Example of available capture interfaces on a Linux system:
<syntaxhighlight lang="console">
$ tcpdump -D
1.eth0 [Up, Running, Connected]
2.any (Pseudo-device that captures on all interfaces) [Up, Running]
3.lo [Up, Running, Loopback]
4.bluetooth-monitor (Bluetooth Linux Monitor) [Wireless]
5.usbmon2 (Raw USB traffic, bus number 2)
6.usbmon1 (Raw USB traffic, bus number 1)
7.usbmon0 (Raw USB traffic, all USB buses) [none]
8.nflog (Linux netfilter log (NFLOG) interface) [none]
9.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]
10.dbus-system (D-Bus system bus) [none]
11.dbus-session (D-Bus session bus) [none]
12.bluetooth0 (Bluetooth adapter number 0)
13.eth1 [none, Disconnected]
</syntaxhighlight>