The steps mentioned in this guide are supposed to work on any Linux system with the following requirements met:

Using Wireshark for analyzing the captured Tcpdump session.įor this tutorial, we are using two Ubuntu 20.04 machines.Sending the Capture file to the onsite machine(Host 1) on which Wireshark is installed.Capturing traffic with Tcpdump and saving the Capture.Connecting with the remote machine(Host 2) with SSH.Here we are pointing out the work we are going to do in this guide: In this guide, we will see how we can interact Tcpdump with Wireshark. Let us now turn to the main purpose of this guide. New users may find it daunting at first when they start to use it and can find many hard-to-remember commands and syntax. Since it is based on the command-line interface, it is not as simple to handle as Wireshark. Tcpdump is a separate application and should not be thought of as a Wireshark command-line interface. It serves the same purpose as Wireshark, which is capturing and analyzing traffic. Tcpdump is a command-line alternative to Wireshark. To look at various options that can be used with Tcpdump, search for the man pages. For e.g., if the target machine you are capturing packet on is a remote one without Wireshark installed on it or it is just a remote headless machine, in both cases, Tcpdump is very handy. Well here is the answer for this: Sometimes it is more convenient to use Tcpdump for packet capturing as compared to Wireshark. Why do you need Tcpdump?Īn obvious question that may come to mind is why care about Tcpdump when you can do almost everything with Wireshark. This tutorial uses Ubuntu as OS, but it is applicable to other Linux distributions too. I will use the Tools Tcpdump and Wireshark.

In this guide, I will show you how to analyze network Packets on Linux.

Ubuuntu tcpdump wireshark