When a web developer claims their application is sending data properly, but the database administrator claims they are receiving nothing, how do you prove who is right? Or, if you suspect a rogue background application on your Mac is secretly sending telemetry data to an unknown server, how do you catch it? You cannot rely on high-level application logs. You must look at the actual microscopic packets of data flowing across your network card. While you could install a heavy, graphical tool like Wireshark, macOS has a powerful, native packet sniffer built directly into the Terminal: tcpdump.
What is tcpdump?
tcpdump is a command-line utility that intercepts and displays TCP/IP packets being transmitted or received over a network interface. Because it operates at the kernel level (putting the network card into promiscuous mode), it requires root privileges to run.
Step 1: Identify Your Interface
Before you can sniff packets, you need to tell tcpdump which network card to listen to. Usually, Wi-Fi is en0 and Ethernet is en1, but you should verify this.
ifconfigLook for the interface that has a valid inet (IPv4) address assigned to it.
Step 2: Start a Basic Capture
To capture absolutely everything flowing across your Wi-Fi card (en0), run:
sudo tcpdump -i en0Your terminal will instantly flood with thousands of lines of text as every single packet (DNS requests, background iCloud syncing, web browsing) is printed to the screen. Press Ctrl + C to stop the capture.
Because a raw capture is too overwhelming to read, you must use filters.
Step 3: Filtering by Host or IP
If you want to see exactly what data your Mac is sending to a specific server (e.g., a local database at 192.168.1.50):
sudo tcpdump -i en0 host 192.168.1.50If you only want to see traffic coming from that IP address, use src:
sudo tcpdump -i en0 src 192.168.1.50Step 4: Filtering by Port and Protocol
If you are troubleshooting a web server and only want to see unencrypted HTTP traffic (Port 80) and HTTPS traffic (Port 443), you can combine filters using logical operators (and, or).
sudo tcpdump -i en0 'tcp port 80 or tcp port 443'Notice the single quotes around the filter expression; these are required to prevent the bash shell from misinterpreting the spaces.
If you want to see all DNS queries (which run on UDP port 53) to see exactly what websites your Mac is trying to resolve in the background:
sudo tcpdump -i en0 udp port 53Step 5: Saving the Capture to a PCAP File
Reading packets scrolling past in real-time in the Terminal is difficult, especially if you need to analyze the actual payload (the data inside the packet) rather than just the headers.
The standard industry practice is to use tcpdump to capture the data to a file, and then open that file later in a graphical tool like Wireshark for deep analysis. You use the -w (write) flag to save a .pcap (Packet Capture) file.
sudo tcpdump -i en0 -w /tmp/network_capture.pcap 'tcp port 443'The terminal will remain blank while it silently records all HTTPS traffic to the file. When you are done, press Ctrl + C.
You can now transfer that .pcap file to any computer and open it in Wireshark. By mastering tcpdump, you gain the ability to perform forensic-level network diagnostics on any Mac without installing any third-party software.