About
tcpdump reads traffic passing over a network interface and prints a summary of each packet. Reach for it when you need to see what is really on the wire. Capture rules narrow the output to one host, port or protocol.
Install it
pkg install tcpdump
Run this inside Termux. If the package is already present, pkg will say so and
do nothing.
Commands worth knowing
6 of the invocations you will actually reach for. Tap the copy button to put one on your clipboard.
tcpdump -i wlan0 -c 20 Capture the next twenty packets on Wi-Fi, then stop. A quick look at the link. tcpdump -i wlan0 port 53 Show DNS traffic only. The fastest way to watch name resolution. tcpdump -i any host 192.168.1.5 Filter to a single machine. You watch one device without unrelated chatter. tcpdump -i wlan0 -w capture.pcap Write raw traffic to a file instead of the screen. Open it later in a proper analyser. tcpdump -r capture.pcap -nn Read a saved capture back with numeric addresses. Faster on a slow resolver. tcpdump -i wlan0 -A port 80 Print packet payloads as text. You can read an unencrypted HTTP exchange directly. Worked example
Run tcpdump -i wlan0 -c 5 port 53 and this is what you should see.
$ tcpdump -i wlan0 -c 5 port 53
10:00:01.123456 IP 192.168.1.42.53124 > 1.1.1.1.53: 41234+ A? example.com. (29)
10:00:01.131002 IP 1.1.1.1.53 > 192.168.1.42.53124: 41234 1/0/0 A 93.184.216.34 (45)
10:00:02.223344 IP 192.168.1.42.53130 > 1.1.1.1.53: 41235+ AAAA? example.com. (29)
5 packets captured
5 packets received by filter Developed by
The Tcpdump Group .