A saved PCAP is often the packet evidence left after the capture window has closed. Reading it with tcpdump lets an operator confirm that the file opens, identify the first flows, and narrow packets for a ticket without returning to the live capture interface.

The -r option reads saved pcap and pcapng files instead of listening on an interface. Tcpdump still applies the same libpcap filter expression used during live capture, so one saved file can be narrowed by host, protocol, port, direction, or packet count.

Use -nn when the exact addresses and ports matter because name or service lookup can hide what was captured. Reading a file does not require capture privileges, but saved packets can still contain payload bytes, internal addresses, cookies, tokens, and other data that should be sanitized before sharing.

Related: How to save traffic to a PCAP file using tcpdump
Related: How to show packet payloads in tcpdump
Related: How to open and analyze PCAP files using Wireshark

Steps to read a saved PCAP file using tcpdump:

  1. Confirm that the saved file is a readable PCAP before treating it as evidence. 
    $ file /tmp/incident.pcap
/tmp/incident.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 262144)
  2. Read a bounded set of packets with numeric output. 
    $ tcpdump -nn -r /tmp/incident.pcap -c 4
reading from file /tmp/incident.pcap, link-type EN10MB (Ethernet), snapshot length 262144
10:41:25.543211 IP 192.0.2.40 > 203.0.113.20: ICMP echo request, id 56, seq 1, length 64
10:41:25.543219 IP 203.0.113.20 > 192.0.2.40: ICMP echo reply, id 56, seq 1, length 64
10:41:26.551802 IP 192.0.2.40 > 203.0.113.20: ICMP echo request, id 56, seq 2, length 64
10:41:26.551811 IP 203.0.113.20 > 192.0.2.40: ICMP echo reply, id 56, seq 2, length 64

    Use -c on large captures so an initial review stops after enough packets to confirm the file and traffic type.

  3. Apply a filter while reading the saved file. 
    $ tcpdump -nn -r /tmp/incident.pcap 'icmp and host 203.0.113.20' -c 2
reading from file /tmp/incident.pcap, link-type EN10MB (Ethernet), snapshot length 262144
10:41:25.543211 IP 192.0.2.40 > 203.0.113.20: ICMP echo request, id 56, seq 1, length 64
10:41:25.543219 IP 203.0.113.20 > 192.0.2.40: ICMP echo reply, id 56, seq 1, length 64

    Quote filters that contain spaces or operators so the shell passes the expression to tcpdump unchanged.

    Related: How to filter network traffic in tcpdump

  4. Increase verbosity when IP or transport header fields matter. 
    $ tcpdump -nn -vv -r /tmp/incident.pcap -c 2
reading from file /tmp/incident.pcap, link-type EN10MB (Ethernet), snapshot length 262144
10:41:25.543211 IP (tos 0x0, ttl 64, id 35816, offset 0, flags [DF], proto ICMP (1), length 84)
    192.0.2.40 > 203.0.113.20: ICMP echo request, id 56, seq 1, length 64
10:41:25.543219 IP (tos 0x0, ttl 63, id 48112, offset 0, flags [none], proto ICMP (1), length 84)
    203.0.113.20 > 192.0.2.40: ICMP echo reply, id 56, seq 1, length 64

    Use payload output only when the capture was made with enough snapshot length and the data is safe to expose.

    Related: How to show packet payloads in tcpdump

  5. Print date-prefixed timestamps when matching packets to logs. 
    $ tcpdump -nn -tttt -r /tmp/incident.pcap -c 2
reading from file /tmp/incident.pcap, link-type EN10MB (Ethernet), snapshot length 262144
2026-06-05 10:41:25.543211 IP 192.0.2.40 > 203.0.113.20: ICMP echo request, id 56, seq 1, length 64
2026-06-05 10:41:25.543219 IP 203.0.113.20 > 192.0.2.40: ICMP echo reply, id 56, seq 1, length 64