Tcpdump is amazing

Re:Tcpdump is amazing by mercora on Thursday March 17, 2016 @05:45AM (#11303412)

I guess the most obvious thing is what it not has, which is a massive GUI. It is much faster to work with when you know what you are looking for in my opinion. In most cases running wireshark without tcpdump first is really inadequate.

[ Parent | on HN ]

Re:Tcpdump is amazing by eric_bullington on Thursday March 17, 2016 @05:53AM (#11303443)

For wireshark, there is tshark for a nice command-line based version with none of the GUI overhead. But usually, I'd rather just use tcpdump.

[ Parent | on HN ]

Re:Tcpdump is amazing by zaro on Thursday March 17, 2016 @06:07AM (#11303479)

True.

My usage or Wireshark is rather sporadic, so I appreciate the traffic drill down I can do w/o any knowledge in advance about the protocols I have captured.

[ Parent | on HN ]