Question: can tcpdump capture dropped packets?
Answer: 2 Answers. The problem can be with tcpdump itself: If it doesn't respond quickly enough then old packets will be overwritten with new ones, which means that they are dropped. If you capture all the bytes of each packet, it's very easy to overrun the kernel's packet capture buffer.