How to Use the macOS built-in tcpdump Command for Network Packet Sniffing

The Hidden Power of macOS Terminal

When Mac users experience strange network issues-such as an application silently failing to connect to an API, or a suspicion that malware is communicating in the background-they often reach for heavy, third-party GUI applications like Wireshark. While Wireshark is excellent, installing and configuring it can be overkill for quick troubleshooting.

macOS actually includes a powerful, industry-standard packet sniffer built directly into the operating system: tcpdump. Because it is natively integrated into the Unix underpinnings of macOS, you can use it immediately from the Terminal to capture, filter, and analyze live network traffic without downloading any additional software.

Understanding tcpdump Basics

The tcpdump command intercepts and displays TCP/IP and other packets being transmitted or received over a network to which your Mac is attached. Because it inspects raw network traffic, it requires root privileges (using sudo).

Step 1: Identify Your Network Interface

Before you can sniff packets, you need to tell tcpdump which network interface to listen to (e.g., your Wi-Fi card or Ethernet adapter).

1. Open the Terminal app (found in Applications > Utilities).
2. Run the following command to list all available network interfaces:

tcpdump -D

Look for the interface that corresponds to your active connection. On most modern MacBooks, the primary Wi-Fi interface is en0.

Step 2: Basic Packet Capturing

To start capturing all traffic on your Wi-Fi interface, run:

sudo tcpdump -i en0

Your terminal will immediately flood with network traffic. To stop the capture, press Ctrl + C.

Step 3: Filtering the Noise

Capturing all traffic is rarely useful because the sheer volume of data is impossible for a human to read. The real power of tcpdump lies in its filtering expressions.

Filter by Host (IP Address or Domain)

If you want to see only the traffic going to or coming from a specific server (e.g., 8.8.8.8):

sudo tcpdump -i en0 host 8.8.8.8

Filter by Port

If you are troubleshooting a web server issue and only want to see HTTP (port 80) and HTTPS (port 443) traffic:

sudo tcpdump -i en0 port 80 or port 443

Filter by Protocol

To see only ICMP traffic (which is useful if you are trying to figure out why ping is failing):

sudo tcpdump -i en0 icmp

Step 4: Making the Output Readable

By default, tcpdump tries to resolve IP addresses into hostnames, which can slow down the capture and clutter the output. Furthermore, it only shows the packet headers, not the actual data payload.

Use these flags to improve your troubleshooting:

• -n: Do not resolve IP addresses to hostnames. (Highly recommended for speed).
• -v or -vv: Increase verbosity to show more packet header details.
• -X: Print the data payload of each packet in both hex and ASCII. This is crucial if you are trying to read unencrypted API requests or plaintext HTTP traffic.

Example combining these flags to inspect HTTP traffic:

sudo tcpdump -i en0 -n -X port 80

Step 5: Saving Captures for Wireshark

Sometimes you need to capture a specific event in the Terminal but want to analyze it later using Wireshark’s graphical interface. You can tell tcpdump to write the raw packets to a .pcap file instead of printing them to the screen.

sudo tcpdump -i en0 -w ~/Desktop/network_capture.pcap

Let this run until the issue occurs, press Ctrl + C, and then you can open the resulting file on your Desktop directly in Wireshark.

Conclusion

The native tcpdump command is an indispensable tool for macOS power users and network administrators. By mastering a few simple filtering commands, you can diagnose complex routing issues, verify firewall rules, and inspect API payloads in seconds directly from the Terminal.