Movatterモバイル変換

This is the home web site oftcpdump, a powerful command-line packet analyzer; andlibpcap, a portable C/C++ library for network traffic capture.

Here you can find the latest stable version oftcpdump andlibpcap, as well as current development versions, a complete documentation, and information about how to report bugs or contribute patches.

The man pages and other documentation within releases andcurrent development versions usually contain the most up to date information. Below you can find online versions of some of these documents, as well as tutorials and in-depth papers written by various authors.

tcpdump

• The most useful for tcpdump users:tcpdump(1) andpcap-filter(7) man pages.
• Other documents: README, installation notes and change log.
• Let's learn tcpdump! by Julia Evans.
• Tcpdump for dummies by Alexander Sandler.
• A tcpdump tutorial with examples by Daniel Miessler.
• tcpdump cheat sheet by Jeremy Stretch.
• tcpdump advanced filters by Sebastien Wains.
• tcpdump little book by Nan Xiao.

libpcap

• pcap(3PCAP) andrpcapd(8) man pages.
• Other documents: README, installation notes and change log.
• Programming with pcap by Tim Carstens.
• The BSD Packet Filter: A New Architecture for User-level Packet Capture by Steven McCanne and Van Jacobson (Usenix Winter 1993). [PDF version]
• Berkeley Packet Filter Instruction Set Architecture — a digest of the above document and various related developments.
• libpcap: An Architecture and Optimization Methodology for Packet Capture by Steve McCanne, CTO Riverbed Technology (Sharkfest'11).
• The Sniffer's Guide to Raw Traffic by Martìn Casado.
• Aprendiendo a programar con libpcap (in Spanish), by Alejandro Lopez Monge.
• Programming with Libpcap - Sniffing the network from our own application by Luis MartinGarcia (Hakin9 Magazine, issue 2/2008). [code samples]
• Develop a Packet Sniffer with Libpcap by Vic Hargrave.
• Using libpcap in C by John Daniel Leon.
• What we talk about when we talk about pcap expressions by Nik Sultana.
• BPF and tcpdump by Andreas Karis.
• BPF Exam is an online tool for Berkeley Packet Filter bytecode visualization. It allows to specify various filter compilation parameters and produces the results in several output formats.
• BPF Simulator is another BPF visualization tool. It allows to see how the same filter program applies to several packets.

tcpdump

Version: 4.99.6
Release Date: December 30, 2025
Download:tcpdump-4.99.6.tar.xz (change log) (PGPsignature andkey)
CLOC analysis and diffs report:Fossies

This tcpdump release makes various improvements and bug fixes available whilst the work on tcpdump 5.0 is still in progress. This release requires libpcap 1.10.5 or later to pass all test cases.

libpcap

Version: 1.10.6
Release Date: December 30, 2025
Download:libpcap-1.10.6.tar.xz (change log) (PGPsignature andkey)
CLOC analysis and diffs report:Fossies

This libpcap release makes various improvements and bug fixes available whilst the work on libpcap 1.11 is still in progress. Among other things this includes the fixes to two vulnerabilities (CVE-2025-11961 discovered by Jin Wei, Kunwei Qian and Ping Chen, and CVE-2025-11964 discovered by Aniruddhan Murali, Noble Saji Mathews, Mahmoud Alfadel, Mei Nagappan and Meng Xu).

The current development versions are freely accessible through the GitHubGit hosting site (tcpdump,libpcap). You can clone these repositories with the following commands:

git clone https://github.com/the-tcpdump-group/tcpdumpgit clone https://github.com/the-tcpdump-group/libpcap

A read-only git mirror of all project repositories is availablehere in case anyone needs it. After cloning the git repositories you can configure and compile the source via either GNU Autoconf or CMake. There is variouscontinuous integration involved in the development process.

tcpdump-workers

This list is focused on development, it also receives announcements. You can subscribehere or by sending an e-mail totcpdump-workers-request@lists.tcpdump.org with the word"subscribe" as body and subject. A list archive, dating back to 2002-10-01, can be foundhere, and an archive dating back to 1999-10-18 can be foundhere. Posts to this list must originate from the subscriber's address.

Please useGitHub as follows:

• Read the guidelines for contributing (tcpdump,libpcap).
• Submit bug reports and feature requests using the issue tracker (tcpdump,libpcap).
• Submit patches by forking the repository (tcpdump,libpcap) and opening a pull request.

tcpdump andlibpcap are open source software and anyone can make contributions. You can help by:

• downloading and testinglibpcap andtcpdump on your platform
• contributing code
• proofreading the documentation and the man pages
• providing.pcap files for protocols or protocol features that tcpdump supports, but does not test yet
• helping to improve thecontinuous integration scripts and infrastructure

If you want to contribute, please subscribe to thetcpdump-workers mailing list. It's a good idea to discuss bugfixes and new feature additions in advance, because the changes may have bigger implications than you think and your patch may not get accepted.

tcpdump andlibpcap are under a3-clauseBSD license. While the current authors have no objection to converting to a2-clause BSD license, the number of contributors that would need to agree makes this change unpracticable.