Jon Schipp explains why tcpdump lags behind Wireshark: fewer protocol dissectors, no built-in high-performance I/O, and weaker vendor support for new protocols. But tcpdump's simplicity and ubiquity across Unix systems make it invaluable for experienced analysts who know how to read its text output.
Chapters
I'm a big fan of TCPdump, but it does have limitations. And an example of one of those limitations is its, its ability to do protocol decoding. Wireshark, for example, is much better. It has so many more dissectors, and so does its command-line counterpart, tshark. Have many more dissectors and better support for writing dissectors, and it's much more widely used. So people tend to write, including vendors, tend to write dissectors for those protocols or for Wireshark for their protocols. But with tcpdump, you don't really have all that. You have a lot of the older stuff. It doesn't seem to be— well, it is still actively maintained, it doesn't grow as such in the same way that Wireshark is when it comes to protocol decoding and dissection. Another reason that tcpdump is— or another way that tcpdump is limited is it doesn't have a lot of support for different I/O methods or high-performance packet capturing. You can use some of the tricks or tips that I've given you in the performance video, or you can, you know, compile it with specific drivers or a new socket infrastructure such as pfRing or netmap to take advantage of host-based load balancing and direct NIC access technologies and so on and so forth. But by itself, TCPdump does not have that enabled. Though TCPdump does excel at its widespread use and adoption, especially in the Unix world. It is available, it is very ubiquitous and available in all the Unix to Unix-likes operating systems I've ever encountered and plenty that I've not encountered. And one other thing about tcpdump, it's not so much of a limitation, but its output is very, is very terse. It is just the textual data for the protocols, and it requires an analyst to have a great deal of knowledge in how to interpret them. tcpdump doesn't give you any extra hints or clues or indications of what certain things might be or what they should appear to be. That's all up for the analyst to decide. But in that regard, it does make TCDump pretty dang good. So it's, it's used for it from experienced analysts, and it's always there when you need it. And that's why I'm a big fan of TCDump.
