tcpdump

JSON
executablemacOS2.2 MBx86_64, arm64

Packet capture utility — captures and analyzes raw network traffic

Provides raw packet capture functionality for network analysis and diagnostics. Intercepts network traffic at the packet level and exposes it through a library interface for other processes. Contains telemetry collection with references to multiple bundle identifiers and network endpoints for reporting diagnostic data. Includes 4 standard frameworks supporting network operations and analysis.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
2.2 MB
UUID
8D2E5A36-9FAF-3CF2-BC82-B9285DE15C68
Analyzed
2026-04-09T10:16:52Z
CDHash
0717eee5514263c32551fd61776f6c23380654b06e779524527d4ea30d809a46

Capabilities

NetworkRaw packet capture library
/usr/lib/libpcap.A.dylib

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
1
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
60
File Paths
0
Bundle IDs
3
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 881 functions identified

Functions(881)

0x100000770intoa
0x100000810ipaddr_string
0x10000095cnewhnamemem
0x100000a08ip6addr_string
0x100000b78newh6namemem
0x100000c24etheraddr_string
0x100000dd4lookup_emem
0x100000ec0le64addr_string
0x100000fbclookup_bytestring
0x100001164linkaddr_string
0x1000012e8isonsap_string
0x100001550tcpport_string
0x100001614udpport_string
0x1000016d8ipxsap_string
0x1000017c8init_addrtoname
0x100001b60dnaddr_string
0x100001be0ieee8021q_tci_string
0x100001c4clookup_protoid
0x100001d40addrtostr
0x100001e08addrtostr6

Imports215 symbols from 3 dylibs

Exports2

_mh_execute_header0x0
bpf_dump0x2104