61.8. Using tcpdump to Monitor TCP Traffic

The tcpdump program is a useful debugging tool that allows the superuser to monitor the Internet traffic on a live network, generating a real-time textual equivalent of diagrams such as Figure 61-3. Despite its name, tcpdump can be used to display traffic for all kinds of network packets (e.g., TCP segments, UDP datagrams, and ICMP packets). For each network packet, tcpdump displays information such as timestamps, the source and destination IP addresses, and further protocol-specific details. It is possible to select the packets to be monitored by protocol type, source and destination IP address and port number, and a range of other criteria. Full details are provided in the tcpdump manual page.

Note:

The wireshark (formerly ethereal; http://www.wireshark.org) program performs a similar task to tcpdump, but displays traffic information via a graphical interface.