tcpdump Save to PCAP: Write to File with -w Flag (2026)

The -w flag in tcpdump doesn’t just save packets; it serializes the live network traffic into a specific binary format called PCAP, which is the de facto standard for network packet capture.

Let’s see it in action. Imagine you’re debugging a slow connection to a web server. You’d start tcpdump like this:

sudo tcpdump -i eth0 -w /tmp/webserver_capture.pcap 'host 192.168.1.100 and port 80'

Here’s what’s happening:

• sudo: tcpdump needs root privileges to capture raw network packets.
• -i eth0: This specifies the network interface to listen on. Replace eth0 with your actual interface (e.g., enp0s3, wlan0).
• -w /tmp/webserver_capture.pcap: This is the crucial part. It tells tcpdump to write the captured packets to the file /tmp/webserver_capture.pcap in PCAP format. If the file exists, it will be overwritten.
• 'host 192.168.1.100 and port 80': This is a filter expression. It tells tcpdump to only capture traffic destined for or originating from the IP address 192.168.1.100 and specifically on port 80 (HTTP). Without a filter, you’d capture everything, which is usually too much.

Once you’ve captured enough data (e.g., by hitting Ctrl+C), you’ll have a file like /tmp/webserver_capture.pcap. You can then analyze this file offline using tcpdump itself or more sophisticated tools like Wireshark.

To read the file back with tcpdump:

tcpdump -r /tmp/webserver_capture.pcap -n 'host 192.168.1.100'

• -r /tmp/webserver_capture.pcap: Reads packets from the specified PCAP file.
• -n: Prevents tcpdump from resolving IP addresses to hostnames and port numbers to service names, which makes the output faster and often clearer for debugging.
• 'host 192.168.1.100': A filter applied during reading, showing only traffic involving that host from the captured data.

The PCAP format is designed to be generic, allowing different packet capture tools and operating systems to write and read the same files. It includes metadata like timestamps, packet lengths, and the raw packet data itself. This standardization is why you can capture on Linux with tcpdump and analyze the .pcap file on a Windows machine with Wireshark.

The magic of the -w flag is its ability to serialize raw network events into a structured, timestamped, and portable data format. Instead of just showing you packets on your screen in real-time, it creates a persistent record that can be replayed, filtered, and analyzed extensively later. This separation of capture and analysis is key to effective network troubleshooting. You can capture data on a busy production server without impacting its performance by offloading the analysis to a separate machine.

When you use -w, tcpdump is not just dumping text; it’s constructing a binary file. Each record in the PCAP file is a pcaprec_hdr_t structure followed by the actual packet data. This structure contains the timestamp (seconds and microseconds), the actual length of the packet data, and the original length of the packet before any potential link-layer truncation. The -w flag ensures these structures are written correctly to disk, preserving critical timing and length information that would be lost in a simple text dump.

If you’re seeing very large .pcap files, it’s often because you’re capturing too much data. The solution isn’t to change -w, but to refine your filter expression. For instance, if you’re only interested in HTTP traffic, your filter should be precise: 'tcp port 80 or tcp port 443' is much more efficient than capturing all traffic on a busy interface. This reduces the file size and speeds up subsequent analysis.

The next step after mastering PCAP capture is understanding how to interpret the data within the PCAP file, which often involves diving into the nuances of network protocols using tools like Wireshark.