mozillazg/ptcpdump

Health v2 · maintenance only

Adoption not part of the score

1264 stars · 67 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ptcpdump is a tcpdump-compatible packet analyzer built on eBPF that automatically annotates captured packets with process, container, and Kubernetes pod metadata. It supports tcpdump-style flags and pcap-filter syntax, and writes PcapNG files with embedded metadata viewable in Wireshark.

Use cases

• capture network packets filtered by process id or process name
• troubleshoot which container or pod is generating network traffic
• capture packets with tcpdump-like syntax but with process context
• analyze packet captures in Wireshark with embedded process metadata
• debug network issues in Kubernetes pods
• perform low-overhead kernel-space packet filtering with eBPF
• capture traffic across multiple network namespaces
• network forensics identifying which process sent specific packets

When to choose

• you need to know which process, container, or pod generated captured traffic
• you want tcpdump compatibility with richer metadata
• you are debugging networking on modern Linux (kernel >= 5.2) with BTF support
• you want kernel-space filtering to reduce capture overhead
• you need PcapNG output with metadata for Wireshark analysis

When to avoid

• you are on Linux kernels older than 5.2 or without BPF/BTF support
• you need a cross-platform sniffer for macOS or Windows
• you just need plain tcpdump without process/container context
• you cannot mount debugfs or load eBPF programs due to restricted privileges

Facets

cli-tool · maturity active

networking monitoring security developer-tools networking security developer-tools cli ebpf tcpdump packet-capture pcapng wireshark process-aware container-observability kubernetes forensics sniffer containers command-line linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mozillazg/ptcpdump")