sudo tcpdump -i en0 -n port 53Watch DNS traffic on Wi-Fi without resolving names.
When to use it
Use tcpdump when you need to see the actual packets: whether DNS queries go out, whether a server answers, which side closes a connection. It captures everything on an interface, so filter tightly and only capture traffic you're allowed to.
Steps
Pick the interface
List interfaces with -D. en0 is Wi-Fi on most Macs; utun interfaces belong to VPNs.tcpdump -DCapture with a filter
Filters use BPF syntax: host, port, net, tcp, udp, combined with and, or, not. Press Ctrl+C to stop.sudo tcpdump -i en0 -n host 1.1.1.1 and port 443Limit the capture
-c stops after N packets, so you don't capture forever.sudo tcpdump -i en0 -n -c 20 udp port 53Save to a file
-w writes raw packets to a pcap file you can open in Wireshark. -r reads it back.sudo tcpdump -i en0 -w ~/Desktop/capture.pcap port 443
Output explained
A DNS query and its answer, as tcpdump prints them with -n:
10:24:01.123456 IP 192.168.1.23.53621 > 192.168.1.1.53: 41023+ A? apple.com. (27)
10:24:01.135210 IP 192.168.1.1.53 > 192.168.1.23.53621: 41023 1/4/9 A 17.253.144.10 (318)
- Timestamp, then source address.port > destination address.port.
41023+ A? apple.com.is a query (ID 41023, + means recursion desired) for an A record.1/4/9 A 17.253.144.10is the answer: 1 answer, 4 authority, 9 additional records.- The number in brackets is the payload size.
For TCP you'll see Flags [S] (SYN, connection start), [S.] (SYN-ACK), [.] (ACK), [P.] (data), [F.] (FIN, close) and [R] (reset).
Options and variations
| Flag | Meaning | Example |
|---|---|---|
| -i IF | Interface to capture on | sudo tcpdump -i en0 |
| -n | Don't resolve names or ports | sudo tcpdump -n -i en0 |
| -c N | Stop after N packets | sudo tcpdump -c 50 -i en0 |
| -w FILE | Write packets to a pcap file | sudo tcpdump -w out.pcap -i en0 |
| -r FILE | Read a saved capture | tcpdump -r out.pcap -n |
| -A / -X | Print payload as ASCII / hex and ASCII | sudo tcpdump -A -i en0 port 80 |
| -v / -vv | More protocol detail | sudo tcpdump -vv -i en0 icmp |
Common errors
| Error | Cause | Fix |
|---|---|---|
| tcpdump: en0: You don't have permission to capture on that device | Packet capture needs root | Run it with sudo. |
| No packets on en0 | Traffic goes through a VPN (utun) or another interface | Check route -n get default for the active interface. |
| Can't see HTTPS content | The payload is encrypted with TLS | Expected. tcpdump shows addresses, ports and timing, not encrypted content. |
Do it in the app
For a day-to-day view you don't need packets: LightAtom's connections view shows every connection per app with byte counts, without capturing traffic. Its optional DNS helper uses the same kernel capture as tcpdump, filtered to DNS answers only.
Frequently asked questions
Is tcpdump installed on a Mac?
Yes. macOS includes Apple's build of tcpdump (version 4.99 on macOS 15). It needs sudo to capture.
How do I capture only one website's traffic?
Find the site's addresses with dig, then filter: sudo tcpdump -i en0 -n host 17.253.144.10. Content is encrypted, but you'll see the connection and timing.
How do I open a tcpdump file in Wireshark?
Save with -w file.pcap, then open the file in Wireshark (File › Open). Wireshark's display filters make it easier to explore.
Can tcpdump see other devices' traffic on Wi-Fi?
Normally only your own Mac's traffic. Switched networks and encrypted Wi-Fi don't deliver other devices' packets to you.