Tcpdump cheat sheet

From wiki.comcert.com

Revision as of 06:09, 25 August 2022 by Bert (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to navigation Jump to search

Display packets from A.B.C.D on interface eth0, no name resolution

tcpdump -i eth0 -s 0 -nnn host A.B.C.D

Save packets to tracefile <filename> on interface eth0 with exclusion of ssh

tcpdump -i eth0 -s 0 -w <filename> port not 22

Save icmp packets to tracefile <filename> on interface eth0

tcpdump -i eth0 -s 0 -w <filename> icmp

Packets from host A.B.C.D on port 1234

tcpdump -i eth0 -s 0 host A.B.C.D and port 1234

Packets from host A.B.C.D on port 1234 and ASCII decode on screen

tcpdump -i eth0 -s 0 host A.B.C.D and port 1234 -A

Packets from multiple host

tcpdump -i eth0 -s 0 host 1.2.3.4 or host 5.6.7.8 or ...

Packets on port 1234 for 10 minutes

Read: dump tracefile <filename> once after 600 seconds

tcpdump -i eth0 -s 0 -G 600 -W 1 -w <filename> port 1234

Stop

<Ctrl>-C

Retrieved from "https://wiki.comcert.com/index.php?title=Tcpdump_cheat_sheet&oldid=7914"