I write a program that send TCP packets from localhost to localhost. And I want to use tcpdump to capture the packets. But nothing is captured. My command in Ubuntu:
sudo tcpdump
What argument shall I add? Thanks!
Asked
Active
Viewed 9.7k times
1 Answers
217
sudo tcpdump -i lo
Notes
- If you get
tcpdump: lo: No such device exists, get the name by coping it from the output of
sudo tcpdump -D
For example, if the output is as below you need lo0 (which is reusult 9. here:
1.en0 [Up, Running]
2.p2p0 [Up, Running]
3.awdl0 [Up, Running]
4.llw0 [Up, Running]
5.utun0 [Up, Running]
6.utun1 [Up, Running]
7.utun2 [Up, Running]
8.utun3 [Up, Running]
9.lo0 [Up, Running, Loopback]
Sridhar Sarnobat
- 25,183
- 12
- 93
- 106
unbeli
- 29,501
- 5
- 55
- 57
-
38If you us a Mac run `sudo tcpdump -D` first to get the local interface. In my case it's: `sudo tcpdump -i 3.lo0` – sunsations Dec 10 '13 at 09:09
-
8Get rid of the use of `sudo`, be clear and state that this must be run as root. – Geoffrey Mar 17 '16 at 09:34
-
Yea, it works "out of the box" without having to install special software like on windows, woot! – rogerdpack May 24 '18 at 19:21
-
4For Macs, this changed at some point, now the following works: `sudo tcpdump -i lo0`. – shawkinaw Jul 19 '19 at 20:39
-
dont that pkt have ethernet hdr ? I dont see ethernet hdr contents using tcpdump ? – Abhishek Sagar Aug 09 '20 at 05:04
-
in order to capture on localhost port: "tcpdump -tttt -s0 -X -vv -i tcp port 1080 -w socks.cap" -> "sudo tcpdump -i lo0 -tttt -s0 -X -vv tcp port 1080 -w socks.cap", the latter works – baron.wang Feb 07 '21 at 09:12