How can I inspect IP packets send through currently open TCP connections? I opened a nettop utility in Terminal, which I think lists IP packet, but doesn't tell anything about their content, namely about TCP Data Stream. Any clues? I found the source and destination ports and some other data that doesn't look like http messages. I would like to see how stuff works for educational purposes.

2 Answers 2


You can inspect network packets with WireShark.

This software capture all packets through a network interface, although you can select only the protocol you want by applying a filter in its settings.


In addition, you can use the built in command line tool tcpdump. You will need root privileges to use it (so execute it with the sudo command) - e.g. to see all IP traffic going through your interface, without listening to all other hosts' traffic, you can run:

sudo tcpdump -i en0 -p -vv -A ip 

If you want to limit the output of tcpdump to only show traffic to/from a particular host or IP range, you can do:

sudo tcpdump -i en0 -p -vv -A ip and host


sudo tcpdump -i en0 -p -vv -A ip and net

Read more about tcpdump by running man tcpdump in your Terminal.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .