What is the tcpdump command in Linux used for?
2023
What is the tcpdump command in Linux used for?
- A.
To capture and analyze network packets.
- B.
To display disk usage statistics.
- C.
To monitor CPU and memory usage.
- D.
To manage user accounts.
- E.
To create and manage cron jobs.
Attempted by 3 students.
Show answer & explanation
Correct answer: A
Concept
A packet analyzer (also called a packet sniffer) is a tool that captures the raw frames travelling across a network interface and decodes their protocol headers and payloads, so an administrator can inspect the actual traffic flowing in and out of a machine.
Applying it to tcpdump
tcpdump is the classic command-line packet analyzer on Linux. It attaches to a network interface (for example eth0), captures packets that match an optional filter expression (such as a host, port, or protocol), and prints a decoded line for each packet. It can also write the raw capture to a .pcap file for later analysis in tools like Wireshark. So the purpose of tcpdump is to capture and analyze network packets.
Why the other tasks belong to different tools
Disk usage statistics are reported by df (free and used space per filesystem) and du (space consumed by directories).
CPU and memory usage are watched with top, htop, or vmstat, which sample process and system resource counters.
User accounts are administered with useradd, usermod, userdel, and passwd, which edit the account databases.
Scheduled, recurring jobs are defined through crontab and the cron daemon, which run commands at fixed times.