Watching the Wire
While strace looks at what a process is asking the kernel to do, tcpdump looks at what is actually traveling over the network. It captures raw packets as they arrive at or leave your network interfaces, giving you ground truth about network communication.
If you want to know whether your server is actually receiving DNS responses, whether a firewall is silently dropping your HTTP packets, or whether a TLS handshake is completing successfully, tcpdump is the tool. It answers the question: "Is the data actually moving?"
The Importance of Filters
On a busy server, gigabytes of data pass through network interfaces every second. Running a raw tcpdump with no filters will overwhelm your terminal and generate so much output it becomes useless. The power of tcpdump lies in its Berkeley Packet Filter (BPF) expressions — a filtering language that tells the kernel which packets to capture before they're even handed to tcpdump, letting you narrow a capture down to a specific host, protocol, or port instead of drowning in unrelated traffic.
Captures can also be written to a .pcap file rather than printed live, which you can later open in Wireshark for graphical analysis — essential for complex protocol debugging.
The BPF Connection
The filtering technology tcpdump uses to efficiently discard unwanted packets inside the kernel before they reach user space is called Berkeley Packet Filter (BPF). This is not a coincidence — BPF was originally invented specifically for tcpdump in 1992. The modern eBPF revolution we'll discuss next is a direct descendant of this same idea: run small, safe filter programs inside the kernel to avoid the cost of copying data to user space unnecessarily.