tcpdump

Background

tcpdump is a command-line packet analyzer for Unix-like operating systems. It allows a user to capture and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. The program was created in 1988 by researchers in the Network Research Group at Lawrence Berkeley Laboratory (now Lawrence Berkeley National Laboratory, LBNL): Van Jacobson, Sally Floyd, Vern Paxson, and Steven McCanne. It was developed as part of ongoing TCP/Internet gateway performance research and drew conceptual inspiration from an earlier Sun Microsystems tool called etherfind, though no original etherfind code was reused; McCanne later rewrote key portions from manual specifications specifically to avoid incorporating any proprietary code.

Technical Foundation: BPF and libpcap

tcpdump's efficient packet capture relies on the BSD Packet Filter (BPF), a kernel-level packet filtering mechanism designed by Steven McCanne and Van Jacobson and described in their 1993 USENIX paper. To make the capture, filtering, and trace-file reading and writing logic reusable outside of tcpdump itself, the same LBL team extracted this functionality into a standalone library named libpcap. tcpdump has since been maintained as a relatively thin command-line front end over libpcap, while libpcap itself became the shared foundation for a wide range of other network tools.

Fragmentation and Reunification

By the late 1990s, tcpdump had been bundled into numerous operating system distributions and had accumulated many independent, poorly coordinated patches, resulting in a fragmented landscape of incompatible variants. To address this, developers Michael Richardson and Bill Fenner established the website tcpdump.org in 1999, creating a centralized point of coordination for ongoing development of both tcpdump and libpcap under a collective known as the Tcpdump Group.

Cross-Platform Expansion

Because libpcap was originally Unix-specific, a Windows port called WinPcap was developed by researchers at the Politecnico di Torino to provide equivalent packet-capture functionality on Windows, enabling a Windows counterpart to tcpdump known as WinDump. WinPcap was later maintained by CACE Technologies before being acquired by Riverbed Technology in 2010; its successor project, Npcap, continues to provide packet-capture support for tcpdump-derived tools on modern Windows systems.

Role in Security and Diagnostics

tcpdump gives administrators and security practitioners a low-level, real-time view of traffic traversing a network interface, including protocol headers, flags, and payload data, filtered using the Berkeley Packet Filter expression syntax. It has been used extensively for network troubleshooting, protocol analysis, intrusion detection, and forensic investigation, and its captured trace files (in the pcap format) can be saved and later replayed or analyzed by other tools.

Legacy

tcpdump and libpcap are widely regarded as foundational infrastructure for network analysis software. The pcap file format and API became a de facto standard adopted by graphical tools such as Wireshark (originally Ethereal) and by intrusion-detection systems such as Snort, as well as by countless custom scripts and security utilities. Development of tcpdump and libpcap has continued under the Tcpdump Group into the 2020s, with releases and a public source repository maintained on GitHub, making the tool one of the longest continuously maintained pieces of open-source network software.

Timeline

• 1988tcpdump is created by Van Jacobson, Sally Floyd, Vern Paxson, and Steven McCanne at Lawrence Berkeley Laboratory's Network Research Group.
• 1993Steven McCanne and Van Jacobson publish the USENIX paper describing the BSD Packet Filter (BPF), the kernel mechanism underlying tcpdump's capture performance.
• 1994The packet-capture, capture-file reading, and capture-file writing logic is extracted from tcpdump into the standalone libpcap library.
• 1999Michael Richardson and Bill Fenner establish tcpdump.org to centralize and coordinate previously fragmented development of tcpdump and libpcap.
• 2010Riverbed Technology acquires CACE Technologies, the maintainer of WinPcap, the Windows port of libpcap used by WinDump.
• 2025-12The Tcpdump Group releases tcpdump 4.99.6 and libpcap 1.10.6 while continuing work toward tcpdump 5.0 and libpcap 1.11.