tcpdump

tcpdump is a command-line packet analyser, distributed alongside libpcap, the portable C and C++ library for network traffic capture that underpins it. That pairing is the most important thing to understand about it. libpcap is the capture layer that a great deal of other network tooling is built on, including graphical analysers, so tcpdump is not merely one tool among many but part of the foundation the field rests on.

Being command-line is the practical distinction rather than a limitation. When a problem occurs on a remote server, an embedded device or a machine reachable only over SSH, a graphical analyser is not an option and tcpdump is. The usual workflow reflects this: capture on the remote host with tcpdump, write to a file, then read that file in a graphical analyser locally. Capture and analysis are separate steps, and tcpdump owns the first.

The project publishes the latest stable versions of both tcpdump and libpcap, current development versions, complete documentation, and instructions for reporting bugs or contributing patches. Documentation is thorough, with the tcpdump and pcap-filter man pages singled out as the most useful for users, alongside README files, installation notes and change logs. Link-layer header type references and a security FAQ are also published, the latter mattering because packet capture normally requires elevated privileges.

Notably, the project links to third-party learning material rather than only its own, including Julia Evans's introduction and other tutorials and in-depth papers. That is a fair reflection of how people actually learn the tool. It is free and open source with no licence cost.