Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Guys im trying to test a tcpdump to (im new to Linux by the way).

so here's what i typed in my shell:

$tcpdump src and dst and port ftp

but i get this error:

tcpdump: no suitable device found

what could be the cause guys?

share|improve this question

migrated from May 31 '13 at 10:46

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted

tcpdump is for capturing packets flowing into or out of your network interface (ethernet or wifi) or usb port etc. You will have to specify what interface you want to listen on. Use the command ifconfig to figure out the names of all the network interfaces present of your system. On my computer, the ifconfig command gives me:

eth6      Link encap:Ethernet  HWaddr 08:00:27:9a:24:9d  
          inet addr:  Bcast:  Mask:
          RX packets:69 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:7131 (7.1 KB)  TX bytes:1350 (1.3 KB)
          Interrupt:10 Base address:0xd020 

lo        Link encap:Local Loopback  
          inet addr:  Mask:
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:400 (400.0 B)  TX bytes:400 (400.0 B)

Which shows the name of my ethernet interface as eth6. You will notice that it has the IPv4 address assigned to it as which tells me that my network connection (to my WiFi Router) is working fine.

So I will issue the command:sudo tcpdump -i eth6 dst This will start tcpdump which will capture all packets flowing into and out of my eth6 but it will display only this packets which are destined to

Now I need to create a connection to, so in a separate terminal window, I type: wget This will fetch the homepage (index.html) from

When I switch back to the tcpdump's terminal window, I get:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth6, link-type EN10MB (Ethernet), capture size 65535 bytes
15:05:50.436200 IP anurag-VirtualBox.33365 > Flags [S], seq 4292128566, win 5840, options [mss 1460,sackOK,TS val 4294949922 ecr 0,nop,wscale 6], length 0
15:05:50.493477 IP anurag-VirtualBox.33365 > Flags [.], ack 2638988837, win 92, options [nop,nop,TS val 4294949936 ecr 123640815], length 0
15:05:50.494124 IP anurag-VirtualBox.33365 > Flags [P.], seq 0:112, ack 1, win 92, options [nop,nop,TS val 4294949936 ecr 123640815], length 112
15:05:50.596428 IP anurag-VirtualBox.33365 > Flags [.], ack 1013, win 123, options [nop,nop,TS val 4294949962 ecr 123640915], length 0
15:05:50.901037 IP anurag-VirtualBox.33365 > Flags [F.], seq 112, ack 1013, win 123, options [nop,nop,TS val 4294950038 ecr 123640915], length 0
15:05:50.956092 IP anurag-VirtualBox.33365 > Flags [.], ack 1014, win 123, options [nop,nop,TS val 4294950052 ecr 123641277], length 0
6 packets captured
10 packets received by filter
0 packets dropped by kernel
share|improve this answer
when i issue the command tcpdump, will this constantly monitor me and display those packets captured in the terminal? or these packets captured are stored somwhere? – Monkey May 30 '13 at 9:46
The packets will be captured and displayed live in realtime as the traffic flows in and out. If you want to store the packets in a file on hard disk use the -w flag as described in tcpdump's man page here – lithiumhead May 30 '13 at 10:12

You probably need to execute as superuser in order to access the network device directly.

Sudo the command.

Edit: To clarify, that tcpdump command won't give you much useful information either. Try this:

sudo tcpdump host

Or, if sudo is not available:

su - ; tcpdump host
share|improve this answer

You must log in to answer this question.