Tcpdump prints out a description of the contents of packets on a network interface that match the booleanÂ expression. It can also be run with theÂ -w flag, which causes it to save the packet data to a file for later analysis, and/or with theÂ -r flag, which causes it to read from a saved packet file rather than to read packets from a network interface. In all cases, only packets that matchÂ expression will be processed byÂ tcpdump.
Tcpdump will, if not run with theÂ -c flag, continue capturing packets until it is interrupted by a SIGINT signal (generated, for example, by typing your interrupt character, typically control-C) or a SIGTERM signal (typically generated with theÂ kill command); if run with theÂ -c flag, it will capture packets until it is interrupted by a SIGINT or SIGTERM signal or the specified number of packets have been processed.
WhenÂ tcpdump finishes capturing packets, it will report counts of:
- packets “captured” (this is the number of packets thatÂ tcpdump has received and processed);
- packets “received by filter” (the meaning of this depends on the OS on which you’re runningÂ tcpdump, and possibly on the way the OS was configured – if a filter was specified on the command line, on some OSes it counts packets regardless of whether they were matched by the filter expression and, even if they were matched by the filter expression, regardless of whetherÂ tcpdump has read and processed them yet, on other OSes it counts only packets that were matched by the filter expression regardless of whetherÂ tcpdump has read and processed them yet, and on other OSes it counts only packets that were matched by the filter expression and were processed byÂ tcpdump);
- packets “dropped by kernel” (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on whichÂ tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).
On platforms that support the SIGINFO signal, such as most BSDs (including Mac OS X) and Digital/Tru64 UNIX, it will report those counts when it receives a SIGINFO signal (generated, for example, by typing your “status” character, typically control-T, although on some platforms, such as Mac OS X, the “status” character is not set by default, so you must set it withÂ stty(1) in order to use it) and will continue capturing packets.
Reading packets from a network interface may require that you have special privileges; see theÂ pcap (3PCAP) man page for details. Reading a saved packet file doesn’t require special privileges.