Przykład użycia Po wpisaniu polecenia tcpdump wyświetlane są wszystkie otrzymane pakiety. Aby odfiltrować pakiety, można w cudzysłowie określić typ protokołu (arp, rarp, tcp, udp, ipx itp.), port (np. port 21, portrange 100-200), np.:
root@TEAM:/home/a# tcpdump 'tcp portrange 3000-5000' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 11:52:01.178363 IP xdsl-2581.lubin.dialog.net.pl.4858 > 192.168.0.17.41857: S 2934274754:2934274754(0) win 65535 <mss 1460,nop, nop,sackOK> 11:52:01.362946 IP mcast-62-eit.man.poznan.pl.3792 > 192.168.0.17.41857: S 4223811393:4223811393(0) win 65535 <mss 1460,nop, nop,sackOK> 11:52:04.033362 IP xdsl-2581.lubin.dialog.net.pl.4858 > 192.168.0.17.41857: S 2934274754:2934274754(0) win 65535 <mss 1460,nop, nop,sackOK> 11:52:04.279834 IP mcast-62-eit.man.poznan.pl.3792 > 192.168.0.17.41857: S 4223811393:4223811393(0) win 65535 <mss 1460,nop, nop,sackOK> 11:52:04.560306 IP aotm.npgo.pl.40000 > 192.168.0.17.3894: P 2678547069:2678547239(170) ack 889594676 win 65535
5 packets captured 12 packets received by filter 0 packets dropped by kernel