How do tcpdump and Wireshark divide the work in sudo tcpdump -w capture.pcap -i wlp4s0, followed by opening the file in Wireshark?
tcpdump is the lightweight command-line capturer: it records raw packets from the interface (-i wlp4s0, the Wi-Fi card) into a pcap file (-w capture.pcap). Wireshark is the graphical analyser that opens that file to filter and decode it. Both need root because capturing reads raw traffic.
| tcpdump | Wireshark | |
|---|---|---|
| Interface | Command line | Graphical |
| Strength | Small, runs anywhere (servers, over SSH, small devices) | Deep protocol decoding, filters, stream reassembly |
| Typical role | Capture | Analyse |
Both are built on the same pcap library and the same file format, which is why a capture taken with one opens in the other. Splitting the work is common practice: capture with tcpdump on the machine that sees the traffic (often headless), copy the .pcap file, analyse it in Wireshark on a desktop. It also avoids running a large GUI program with root rights.
The pieces of the command:
sudo: opening an interface for raw capture needs root (on Linux, theCAP_NET_RAWcapability).-i wlp4s0: the interface to capture on.wlp4s0is a typical Linux name for a wireless card (wl= WLAN,p4s0= its PCI position).ip linklists the names on a given machine.-w capture.pcap: write the raw packets to a file instead of printing a summary per packet.
Go deeper:
tcpdump manual — every option, including capture filters to record only some traffic.- Wikipedia — pcap — the capture library and file format shared by both tools.