I have been trying to learn tcpdump and I am using this command to attempt to monitor my network:

sudo tcpdump -I -i en1

But this gives me a bunch of stuff I don't want, so I used this version to filter the packets:

sudo tcpdump -I -i en1 port 80 or 443

And it gives me nothing. I know you can't use your WiFi when using monitor mode, but I still can, so I think thats a sign something is wrong. I tried it with en0, but it couldn't go into monitor mode.

What am I doing wrong?

I am using a MacBook Pro with OS X 10.9.3, and I would like to be able to do this with tcpdump, or any other utility that's built into OS X.


Sometimes the traffic is buffered or delayed by DNS server responses. To avoid it, add -l and -n parameters.

-l Make stdout line buffered. Useful if you want to see the data while capturing it.

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

Then you can use syntax like:

sudo tcpdump -i en1 -nl port http or port https

For more complex queries, make sure you use brackets to group the expressions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.