tcpdump -i lo

Tigran Aivazian (
Mon, 8 Apr 1996 19:24:43 +0000 (GMT)

Hello guys,

I cannot remember who asked this so I have no other choice but to answer to
everyone in hope that the "right" person reads this too. Somebody asked
recently how to dump network traffic from loopback device. On my Linux box
there are two versions of tcpdump :

Version 3.0
Usage: tcpdump [-dDeflnOpqtvx] [-c count] [-i interface]
[-r filename] [-w filename | -W filename] [expr]


Version 3.0.2
Usage: tcpdump [-deflnOpqtvx] [-c count] [-i interface]
[-r filename] [-w filename] [expr]

Looking at README file for 3.0 one discovers that it contains all the features
of standard 3.0.2 and 3.0.3 (patches) of tcpdump. And 3.0 allows to dump lo:
tcpdump -i lo
Whereas 3.0.2 refuses saying "snoop: unknown physical layer". So, those
who wish to dump loopback traffice should go to and get a file


PS. If you want to dump sl? traffic make sure you looked at print-sl.c file
and #define CSLIP in there because configure script seems to miss that one.