0

As all three tools are packet sniffers, I would have expected them to give me the same results when I use them to monitor my home's network, but they don't. Therefore what are the core differences and which one is the best to use?

Improve this question
1
  • 1
    How do you mean "different results" between Wireshark and TCPdump output?
    – skooog
    Sep 27, 2017 at 14:13

1 Answer 1

Reset to default
2

Airdump-ng is for capturing 802.11 frames, so you use this tool exclusively for wireless networks.

Wireshark and TCPdump are similar but Wireshark is more complex, also has a GUI. E.g. you can set many filters and perform more advanced analysis. TCPdump is more lightweight.

Which one is best to use is a broad question and is up to you, depending on what you need. You don't have to limit yourself to one if you think you need several different sniffers.

Improve this answer
1
  • More specifically - airodump-ng (sic) is 802.11-specific in that it allows for controlling the current radio channel of the monitoring wlan-device, plus "scanning" by switching across multiple channels. tcpdump has no such concept and requires using some separate tool to set the channel first before capturing. Wireshark has some build-in UI support for controlling a USB capture device but again it is much more heavyweight.
    – conny
    Jan 19, 2022 at 5:04

Not the answer you're looking for? Browse other questions tagged .