Play sounds in response to network traffic

The tcpsound(1) utility will play sounds in response to network traffic permitting a user to literally listen to a network. Specifically tcpsound forks a pseudo terminal in which to run tcpdump(8), parses that output, and plays a wide variety of user configuable sounds. Interpreting the output of tcpdump in a pty permits tcpsound to first ssh(1) to a remote host if desired.


To install tcpsound you will need tcpdump(8) on the machine on which you will be capturing packets. On the local machine (where you will be playing the sounds of those packets) the libsdl sound library and unless you're using the OSX binary package libmba-0.9.1 or later is required. Libsdl is fairly standard on Linux machines but you may need to install development packages (specifially SDL-devel and SDL_mixer-devel for my RH 7.3 machine). For OSX I built the source package from


Provided the above requirements have been met, the sound is working properly on the local machine, and the user has root access on both the target machine (to capture packets in promiscuous mode) and local machine (to access the sound device), a typical commandline for tcpsound is:

  # tcpsound -r ! port ssh

This will forkpty(3), ssh to, run tcpdump -nn ! port ssh (note the ! port ssh filter is important so you're not listening to yourself) and interpret the output playing sounds defined in the /root/.tcpsound config. Adjust the configuration file to associate different WAV files with incoming or outgoing traffic on specific ports. See the tcpsound(1) man page for details.

Mac OSX Binary

A binary package for Mac OSX has also been prepared. This package does not need libmba but it does need libSDL. Install libSDL first. Then to install tcpsound and run as follows:
$ tar -xvzf tcpsound-0.3.1.darwin.bin.tar.gz
$ cd tcpsound-0.3.1
$ sudo make -f Makefile.darwin install
$ sudo tcpsound -r myserver ! port ssh


Browse The Source


tcpsound-0.3.1 released
Mon Sep 5, 2005
A small build fix has been applied.
tcpsound-0.3.0 released
Fri Apr 29, 2005
This release has been updated to build cleanly with the latest libmba and an OSX binary has been prepared.
tcpsound-0.2.3 released
Wed May 26, 2004
Some logic that tried to compensate for delays in SSH has been removed. It just didn't work that well. Sounds are now played as soon as packets are read from the SSH session.

Also included is a more elaborate configuration. If you have KDE (it makes use of some KDE WAVs in /usr/share/sounds/) try it out.
tcpsound-0.2.2 released
Fri May 22, 2004
Fixed some Makefile proper and added support for ICMP. Still don't have a really clear sonar "ping" sound. I think a high key on the piano with some heavy reverb would do it though.
tcpsound-0.2.1 released
Fri May 21, 2004
Initial release. If anyone has a good clean sonar "ping" WAV for ICMP echos please send it to me!