Skip to content

Latest commit

 

History

History
52 lines (35 loc) · 830 Bytes

tcpdump.md

File metadata and controls

52 lines (35 loc) · 830 Bytes

tcpdump

  • Capture traffic on an interface or all 
tcpdump -i eth0
tcpdump -i any
  • Capture and write to a file 
tcpdump -i eth0 -w file_name.pcapng
  • Read packets from a file, do not resolve hosts/ports
tcpdump -r file_name.pcapng -n
  • Read packets from a file, dont resolve, show as ASCII
tcpdump -r file_name.pcapng -n -A

Useful BPF Examples

  • Traffic going to or from a host 
tcpdump -r file_name.pcapng 'host 192.168.1.34'
  • Traffic coming from host
tcpdump -r file_name.pcapng 'src host 192.168.1.34'
  • Traffic where the source is not a specific host 
tcpdump -r file_name.pcapng 'not src host 192.168.1.34'
  • Only ICMP traffic from a sepecifc host 
tcpdump -r file_name.pcapng 'icmp and (src host 19.168.1.34)