I have been trying to learn tcpdump and I am using this command to attempt to monitor my network:

sudo tcpdump -I -i en1

But this gives me a bunch of stuff I don't want, so I used this version to filter the packets:

sudo tcpdump -I -i en1 port 80 or 443

And it gives me nothing. I know you can't use your WiFi when using monitor mode, but I still can, so I think thats a sign something is wrong. I tried it with en0, but it couldn't go into monitor mode.

What am I doing wrong?

I am using a MacBook Pro with OS X 10.9.3, and I would like to be able to do this with tcpdump, or any other utility that's built into OS X.

1 Answer 1


Sometimes the traffic is buffered or delayed by DNS server responses. To avoid it, add -l and -n parameters.

-l Make stdout line buffered. Useful if you want to see the data while capturing it.

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

Then you can use syntax like:

sudo tcpdump -i en1 -nl port http or port https

For more complex queries, make sure you use brackets to group the expressions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .