When capturing packets with tcpdump, you can limit how many packets to collect using the -c option. This is useful for quick tests, preventing huge files, or avoiding long captures that consume system resources.

Instead of running until you manually stop it, tcpdump will stop after capturing the number of packets you specify.

Use the -c Option

To stop after a set number of packets, use:

tcpdump -i eth0 -c 100

This captures 100 packets on the eth0 interface, then exits automatically.

You can combine it with file saving:

tcpdump -i eth0 -c 50 -w test.pcap

This saves just 50 packets into test.pcap.

Combine with Other Options

You can still use filters and formatting options:

tcpdump -i wlan0 -c 10 -A port 80

This captures 10 HTTP packets on Wi-Fi and prints them in ASCII.