As all three tools are packet sniffers, I would have expected them to give me the same results when I use them to monitor my home's network, but they don't. Therefore what are the core differences and which one is the best to use?

closed as off-topic by RoraΖ, Steve, Steffen Ullrich, schroeder Sep 27 '17 at 16:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – RoraΖ, Steve, Steffen Ullrich, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    How do you mean "different results" between Wireshark and TCPdump output? – skooog Sep 27 '17 at 14:13

Airdump-ng is for capturing 802.11 frames, so you use this tool exclusively for wireless networks.

Wireshark and TCPdump are similar but Wireshark is more complex, also has a GUI. E.g. you can set many filters and perform more advanced analysis. TCPdump is more lightweight.

Which one is best to use is a broad question and is up to you, depending on what you need. You don't have to limit yourself to one if you think you need several different sniffers.

Not the answer you're looking for? Browse other questions tagged or ask your own question.