Why is tcpdump better than Wireshark?
Why would someone use tcpdump to analyze network traffic, instead of using Wireshark?
I heard tcpdump is better, but I'm not sure why. Background. Recently I had a discussion with some co-workers about data formats used to capture and analyze network traffic. My coworker, Joe, mentioned he would like to be able to get the TCP stream data out of the capture file (Wireshark uses pcap), so he could apply his own analysis, instead of the Wireshark default.
Joe: In general, I am just looking for an easy way to analyze packets that are captured off the network. Mike: What do you mean by easy? I have never been able to figure out how to do that with tcpdump. I've spent hours googling, and I just don't understand it.
Joe: I want a format that I can just copy/paste into the editor and change the filters on. Then I can open the file in my IDE and find the packet I am looking for. That's it. No searching through hundreds of options to find the ones I want.
Related Answers
How to analyse Wireshark traffic?
What is the difference between Protocol and Application? How do I f...
Is there a Wireshark for Mac?
(I'm on OS X 10.6.8) After using it for a while, now my question is no...
How to capture Wi-Fi on Wireshark?
In this article, I'll teach you how to capture the Wi-Fi traffic on Wire...