This is the home web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. Here you can find the latest releases of tcpdump and libpcap, as well as current development versions, various documentation, and information about how to report bugs or contribute patches.
Download,
change log,
PGP signature and
key,
man pages,
CLOC
analysis and diffs report.
This libpcap release is a result of nearly six years of
development done by The Tcpdump Group and many contributors. In
calendar year 2025 Sovereign Tech Agency supported this work
financially by contracting one of the maintainers as a part-time
fellow via their Fellowship
program.
This release delivers assorted improvements in the following aspects: the API, the build systems, error detection and reporting, input validation, the man pages and other documentation, and packet filtering. This release introduces unit tests and refactors various source code to facilitate maintenance and future contributions.
Concerning packet capture modules, this release improves support for Endace DAG, Myricom SNF, netmap, and RDMA. It also removes any remaining support for AirPcap, DPDK, Riverbed TurboCap, Septel, and SITA ACN. Concerning platforms, this release adds support for GNU/Hurd and improves support for FreeBSD, illumos, Linux, macOS, NetBSD, OpenBSD, QNX, and Solaris 11. It also removes any remaining support for AOS (4.3BSD Unix), BSD/OS, DOS, HP-UX before 10.20, IRIX, MinGW, {OSF/1, Digital Unix, Tru64 Unix}, SINIX, Solaris 9, SunOS 3.x, 4.x and 5.x before 5.3.2, and Ultrix.
Download,
change log,
PGP signature and
key,
CLOC
analysis and diffs report,
man page.
This tcpdump release improves support for the following network
protocols: BIG TCP, ISAKMP, MPTCP, and TCP (specifically, the new AE flag).
It also fixes building on GNU/Hurd and improves compatibility with QNX.
This release requires libpcap 1.10.5 or later to pass all test cases.
Download,
change log,
PGP signature and
key,
man pages.
This libpcap release fixes a number of vulnerabilities:
CVE-2026-0799
(reported by Include Security in 2018, sponsored by Mozilla under
the Secure Open Source program, but reproduced only in 2026),
CVE-2026-31912,
CVE-2026-31911
(reported by FuzzAnything Organization),
CVE-2026-6244
(reported by Aniruddhan Murali and Noble Saji Mathews in 2025, but
reproduced only in 2026),
CVE-2026-6554
(reported by Kaixuan LI),
CVE-2026-18313
and CVE-2026-18238.
For the CVE-2026-31912 fix to have effect, applications that use
the now deprecated bpf_filter() must be migrated to
pcap_offline_filter(3PCAP).
The man pages and other documentation within releases and current development versions usually contain the most up to date information. Below you can find online versions of some of these documents, as well as tutorials and in-depth papers written by various authors.
To report a security issue, please see this page.
tcpdump and libpcap are open source software. The source code git repositories are available on GitHub (tcpdump, libpcap) and on the read-only mirror. Before opening a bug report, a feature request or a pull request on GitHub please read the guidelines for contributing (tcpdump, libpcap). If you are going to suggest a major change, please also subscribe to the mailing list below and discuss the idea there first because it may have bigger implications than it seems.
You can also help by:
.pcap files for protocols or protocol
features that tcpdump supports, but does not test yettcpdump and libpcap are under a 3-clause BSD license. While the current authors have no objection to converting to a 2-clause BSD license, the number of contributors that would need to agree makes this change unpracticable.