See the list of interfaces on which tcpdump can listen
\n# \/usr\/sbin\/tcpdump -D<\/p>\n
Listen on any available interface
\n# \/usr\/sbin\/tcpdump -i any<\/p>\n
Verbose Mode
\n# \/usr\/sbin\/tcpdump -v
\n# \/usr\/sbin\/tcpdump -vv
\n# \/usr\/sbin\/tcpdump -vvv
\n# \/usr\/sbin\/tcpdump -q<\/p>\n
Limit the capture to an number of packets N
\n# \/usr\/sbin\/tcpdump -c N<\/p>\n
Display IP addresses and port numbers when capturing packets
\n# \/usr\/sbin\/tcpdump -n<\/p>\n
Capture any packets where the destination host is 192.168.0.1, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n dst host 192.168.0.1<\/p>\n
Capture any packets where the source host is 192.168.0.1, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n src host 192.168.0.1<\/p>\n
Capture any packets where the source or destination host is 192.168.0.1, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n host 192.168.0.1<\/p>\n
Capture any packets where the destination network is 192.168.10.0\/24, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n dst net 192.168.10.0\/24<\/p>\n
Capture any packets where the source network is 192.168.10.0\/24, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n src net 192.168.10.0\/24<\/p>\n
Capture any packets where the source or destination network is 192.168.10.0\/24,display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n net 192.168.10.0\/24<\/p>\n
Capture any packets where the destination port is 23, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n dst port 23<\/p>\n
Capture any packets where the destination port is is between 1 and 1023 inclusive, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n dst portrange 1-1023<\/p>\n
Capture only TCP packets where the destination port is is between 1 and 1023 inclusive,display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n tcp dst portrange 1-1023<\/p>\n
Capture only UDP packets where the destination port is is between 1 and 1023 inclusive, display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n udp dst portrange 1-1023<\/p>\n
Capture any packets with destination IP 192.168.0.1 and destination port 23,display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n “dst host 192.168.0.1 and dst port 23”<\/p>\n
Capture any packets with destination IP 192.168.0.1 and destination port 80 or 443,display IP addresses and port numbers
\n# \/usr\/sbin\/tcpdump -n “dst host 192.168.0.1 and (dst port 80 or dst port 443)”<\/p>\n
Capture any ICMP packets
\n# \/usr\/sbin\/tcpdump -v icmp<\/p>\n
Capture any ARP packets
\n# \/usr\/sbin\/tcpdump -v arp<\/p>\n
Capture either ICMP or ARP packets
\n# \/usr\/sbin\/tcpdump -v “icmp or arp”<\/p>\n
Capture any packets that are broadcast or multicast
\n# \/usr\/sbin\/tcpdump -n “broadcast or multicast”<\/p>\n
Capture 500 bytes of data for each packet rather than the default of 68 bytes
\n# \/usr\/sbin\/tcpdump -s 500<\/p>\n
Capture all bytes of data within the packet
\n# \/usr\/sbin\/tcpdump -s 0<\/p>\n
Monitor all packets on eth1 interface
\n# \/usr\/sbin\/tcpdump -i eth1<\/p>\n
Monitor all traffic on port 80 ( HTTP )
\n# \/usr\/sbin\/tcpdump -i eth0 ‘port 80’<\/p>\n
Monitor all traffic on port 25 ( SMTP )
\n# \/usr\/sbin\/tcpdump -vv -x -X -s 1500 -i eth0 ‘port 25’<\/p>\n
Capture only N number of packets using tcpdump -c
\n# \/usr\/sbin\/tcpdump -c 2 -i eth0<\/p>\n
Display Captured Packets in ASCII using tcpdump -A
\n# \/usr\/sbin\/tcpdump -A -i eth0<\/p>\n
Display Captured Packets in HEX and ASCII using tcpdump -XX
\n# \/usr\/sbin\/tcpdump -XX -i eth0<\/p>\n
Capture the packets and write into a file using tcpdump -w
\n# \/usr\/sbin\/tcpdump -w data.pcap -i eth0
\n.pcap is extension<\/p>\n
Reading the packets from a saved file using tcpdump -r
\n# \/usr\/sbin\/tcpdump -tttt -r data.pcap<\/p>\n
Capture packets with IP address using tcpdump -n
\n# \/usr\/sbin\/tcpdump -n -i eth0<\/p>\n
Capture packets with proper readable timestamp using tcpdump -tttt
\n# \/usr\/sbin\/tcpdump -n -tttt -i eth0<\/p>\n
Read packets longer than N bytes
\n# \/usr\/sbin\/tcpdump -w data.pcap greater 1024<\/p>\n
Read packets lesser than N bytes
\n# \/usr\/sbin\/tcpdump -w data1024.pcap less 1024<\/p>\n
Receive only the packets of a specific protocol type
\n# \/usr\/sbin\/tcpdump -i eth0 arp<\/p>\n
Receive packets flows on a particular port using tcpdump port
\n# \/usr\/sbin\/tcpdump -i eth0 port 22<\/p>\n
Capture packets for particular destination IP and Port
\n# \/usr\/sbin\/tcpdump -w data.pcap -i eth0 dst 10.181.140.216 and port 22<\/p>\n
Capture TCP communication packets between two hosts
\n# \/usr\/sbin\/tcpdump -w data.pcap -i eth0 dst 16.181.170.246 and port 22<\/p>\n
Tcpdump Filter Packets \u2013 Capture all the packets other than arp and rarp
\n# \/usr\/sbin\/tcpdump -i eth0 not arp and not rarp<\/p>\n","protected":false},"excerpt":{"rendered":"
See the list of interfaces on which tcpdump can listen # \/usr\/sbin\/tcpdump -D<\/p>\n
Listen on any available interface # \/usr\/sbin\/tcpdump -i any<\/p>\n
Verbose Mode # \/usr\/sbin\/tcpdump -v # \/usr\/sbin\/tcpdump -vv # \/usr\/sbin\/tcpdump -vvv # \/usr\/sbin\/tcpdump -q<\/p>\n
Limit the capture to an number of packets N # \/usr\/sbin\/tcpdump -c N<\/p>\n
Display IP addresses and port numbers […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,17],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5231"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5231"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5231\/revisions"}],"predecessor-version":[{"id":5232,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5231\/revisions\/5232"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}