Which tool is used on BIG-IP systems to capture data packets?

tcpdump is the standard packet capture utility available on F5 BIG-IP systems, and F5 extends it with custom options such as -i 0.0 to capture traffic across all interfaces simultaneously. It is the officially documented method for diagnosing traffic flows on BIG-IP. F5 support frequently requests tcpdump output when troubleshooting connectivity and load balancing issues.

snoop is a packet capture tool specific to Solaris/Oracle systems and is not available on the Linux-based BIG-IP TMOS platform.

Ethereal was the former name of Wireshark and is a GUI-based tool run on a separate host to analyze captures - it is not a tool used directly on BIG-IP.

qkview is an F5 diagnostic data collection utility that gathers logs and configuration snapshots for iHealth analysis, not a packet capture tool.