Windows
Linux
Networking
Windows pktmon equivalent in Linux
Captures packets from network interfaces for troubleshooting and protocol analysis.
Windows
→
pktmon
Linux equivalents
sudo tcpdump -i any
sudo tcpdump -i any
sudo tcpdump -i any
Overview
What this command does
Captures packets from network interfaces for troubleshooting and protocol analysis.
Migration tip:
tcpdump is a command-line packet analyzer. Save captures as PCAP files when you want to inspect them later in Wireshark.Practical tasks
Common use cases
Capture network packets
Captures packets from network interfaces for troubleshooting and protocol analysis.
sudo tcpdump -i any
Capture on all interfaces
sudo tcpdump -i enp5s0 port 53
Capture DNS traffic
sudo tcpdump -i any -w capture.pcap
Save packets to a PCAP file
Ready to run
Copyable Linux commands
Review paths, device names, package names and permissions before running any command.
sudo tcpdump -i any
sudo tcpdump -i enp5s0 port 53
sudo tcpdump -i any -w capture.pcap
Walkthrough
Examples with explanations
sudo tcpdump -i any # capture all visible traffic
sudo tcpdump -i enp5s0 port 53 # capture DNS packets only
sudo tcpdump -i any -w capture.pcap # save a capture for later analysisReference
Common options and variations
| Command or option | Use |
|---|---|
sudo tcpdump -i any | Capture on all interfaces |
sudo tcpdump -i enp5s0 port 53 | Capture DNS traffic |
sudo tcpdump -i any -w capture.pcap | Save packets to a PCAP file |
Distro differences
Debian/Ubuntu vs Fedora vs Arch
This command is the same on Debian/Ubuntu, Fedora and Arch Linux when the relevant tool is installed.
| Distribution | Package manager / base | Equivalent command | Difference to notice |
|---|---|---|---|
| Debian/Ubuntu | same command | sudo tcpdump -i any |
Same command on this distribution. |
| Fedora | same command | sudo tcpdump -i any |
Same command on this distribution. |
| Arch | same command | sudo tcpdump -i any |
Same command on this distribution. |
Important
What to watch out for
Packet captures can contain credentials and private data. Protect capture files and capture only networks you are authorized to inspect.
Keep learning