Alternatives to tcpdump
The classic command-line packet capture and analysis tool. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
tcpdump
The classic command-line packet capture and analysis tool.
Replacements
Listings that take over the same core job as tcpdump.
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
Wireshark adds a graphical interface with dissectors for hundreds of protocols and display filters, reading the same pcap files, on Windows, macOS and Linux.
Termshark
Terminal interface for tshark that feels like Wireshark.
Termshark offers a Wireshark-style terminal interface over SSH on macOS and Linux, using tshark for dissection, which must be installed separately.
ngrep
A command-line packet capture tool that matches network payloads against regular or hexadecimal expressions.
ngrep captures from the command line and matches payloads against regular expressions, but offers text output with no protocol decoding.
Similar software
Related functionality, not a direct replacement.
Npcap
Windows packet capture driver used by Wireshark, Nmap and similar tools.
Arkime
Store and search captured network traffic through a web interface.
NetworkMiner
Network forensics tool that extracts files and credentials from captures.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
Ettercap
Suite for network sniffing and man-in-the-middle analysis on a LAN.
Tcpreplay
A suite of command-line tools for editing captured network traffic and replaying it onto a network.
