# Install tcpdump with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper
Command-line packet analyzer. Version 4.99.6 via Homebrew; verified 2026-06-22. Also installable with debian: sudo apt install tcpdump.
## Install
```sh
sudo av install brew:tcpdump
```
Additional install commands:
### macOS
- Homebrew (100%):
```sh
brew install tcpdump
```
Evidence: local Homebrew formula metadata
- MacPorts (94%):
```sh
sudo port install tcpdump
```
Evidence: MacPorts ports tree: net/tcpdump/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
### Linux
- apk (92%):
```sh
sudo apk add tcpdump
```
Evidence: Alpine Linux edge package indexes: tcpdump from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
- Debian apt (92%):
```sh
sudo apt install tcpdump
```
Evidence: Debian stable package indexes: tcpdump from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
- dnf (92%):
```sh
sudo dnf install tcpdump
```
Evidence: Fedora Rawhide package metadata: tcpdump from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst
- Nix (92%):
```sh
nix profile install nixpkgs#tcpdump
```
Evidence: nixpkgs package indexes: pkgs/by-name/tc/tcpdump/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- pacman (92%):
```sh
sudo pacman -S tcpdump
```
Evidence: Arch Linux sync databases: tcpdump from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
- zypper (92%):
```sh
sudo zypper install tcpdump
```
Evidence: openSUSE Tumbleweed package metadata: tcpdump from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst
## Package facts
- **Package key:** brew:tcpdump
- **Package manager:** Homebrew
- **Version:** 4.99.6
- **Source summary:** Command-line packet analyzer
- **Homepage:**
- **Repository:**
- **Last updated:** 2026-06-22T14:06:26-07:00
- **Generated:** 2026-08-03T19:37:03+00:00
## Executables
- tcpdump (alias)
- tcpdump.4.99.6 (alias)
## Install behavior
- Bottle: not available
## Freshness
- Page generated: 2026-08-03
- Package-manager version: 4.99.6
## Project history and usage
tcpdump is the classic command-line packet analyzer for capturing, filtering, and decoding network traffic, closely tied to libpcap and Unix network troubleshooting culture.
### Project history
The tcpdump source says the program was first written in 1987 by Van Jacobson at Lawrence Berkeley Laboratory. The official README says it was part of research into TCP and Internet gateway performance and was loosely based on Sun's etherfind, with proprietary remnants later rewritten by Steven McCanne.
The current project is maintained by The Tcpdump Group. Its GitHub README describes tcpdump as source code for network monitoring and data acquisition and credits continuing improvements to Internet community contributions.
### Adoption history
tcpdump became a standard Unix and Unix-like diagnostic tool because it combined packet capture, protocol decoding, and Berkeley Packet Filter expressions in a command-line workflow.
The upstream README notes that many operating systems ship tcpdump as a native package or port, which matches its presence across package managers and base-system environments.
### How it is used
Typical use is interactive or scripted packet capture: selecting an interface, applying a capture filter, printing decoded packets, or writing pcap files for later inspection.
The README points to tcpslice for processing tcpdump capture files and to libpcap as the capture interface dependency, which explains why tcpdump is often packaged alongside libpcap.
### Why package nerds care
tcpdump is one of the canonical networking CLIs that package maintainers expect to exist everywhere. Its packaging touches privilege handling, capture library compatibility, platform packet APIs, and manpage fidelity.
For package nerds, it is also part of a toolkit lineage: libpcap provides the capture layer, tcpdump provides the terminal interface, and Wireshark and many other tools consume the same pcap ecosystem.
### Timeline
- 1987: tcpdump first written by Van Jacobson at Lawrence Berkeley Laboratory.
- 1988-2000: Source copyright headers record continuing University of California/LBL-era development.
- 1990s: Original LBL README documents research workflows using tcpdump traces and awk summaries.
- Modern era: The Tcpdump Group maintains tcpdump with community contributions and GitHub-based development.
### Related projects
- libpcap is tcpdump's packet capture library dependency.
- tcpslice is maintained by The Tcpdump Group for extracting portions of tcpdump binary trace files.
- Wireshark is a related packet-analysis tool, but tcpdump remains the compact CLI-oriented analyzer.
### Sources
-
-
-
## Security Notes
doc example: packet capture tool.
- **Geiger risk:** red / high
- doc example: packet capture tool
## Other Package-Manager Records
- Debian apt - tcpdump - 4.99.5-2: normalized package name match | Debian stable package indexes: tcpdump from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | command-line network traffic analyzer | https://www.tcpdump.org/
- Nix - tcpdump: normalized package name match | nixpkgs package indexes: pkgs/by-name/tc/tcpdump/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - tcpdump - 4.99.4-3ubuntu4: normalized package name match | Ubuntu 24.04 LTS package indexes: tcpdump from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | command-line network traffic analyzer | https://www.tcpdump.org/
- apk - tcpdump - 4.99.6-r1: normalized package name match | Alpine Linux edge package indexes: tcpdump from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Command-line packet analyzer | https://www.tcpdump.org/
- apk - tcpdump-doc - 4.99.6-r1: normalized package name match | Alpine Linux edge package indexes: tcpdump-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Command-line packet analyzer (documentation) | https://www.tcpdump.org/
- dnf - tcpdump - 4.99.6-5.fc45: normalized package name match | Fedora Rawhide package metadata: tcpdump from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | A network traffic monitoring tool | http://www.tcpdump.org
- pacman - tcpdump - 4.99.6-1: normalized package name match | Arch Linux sync databases: tcpdump from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Powerful command-line packet analyzer | https://www.tcpdump.org/
- zypper - tcpdump - 4.99.6-1.5: normalized package name match | openSUSE Tumbleweed package metadata: tcpdump from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | A Packet Sniffer | https://www.tcpdump.org/
- MacPorts - tcpdump: normalized package name match | MacPorts ports tree: net/tcpdump/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
## Combined YAML source
View the package source record on GitHub. [combined/tcpdump.yml](https://github.com/mxcl/pkgdb/blob/main/combined/tcpdump.yml)
## Sources
- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph