linux Bag grabbing tool tcpdump Examples of use



The command parameter to save the capture package to the file is -w xxx.cap

grab eth1 Bag of  
tcpdump -i eth1 -w /tmp/xxx.cap

grab 192.168.1.123 Bag of  
tcpdump -i eth1 host 192.168.1.123 -w /tmp/xxx.cap

grab 192.168.1.123 Of 80 Packets for port  
tcpdump -i eth1 host 192.168.1.123 and port 80 -w /tmp/xxx.cap

The target address is 192.168.1.123 Of 80 Packets for port  
tcpdump -i eth1 dst 192.168.1.123 and port 80 -w /tmp/xxx.cap

grab 192.168.1.123 Of icmp Bag of  
tcpdump -i eth1 host 192.168.1.123 and icmp -w /tmp/xxx.cap

grab eth1 wrong arp,rarp Bag of
tcpdump -i eth1 not arp and not rarp

Display in packet capture log IP, No IP analysis
tcpdump -i eth1 -n

grab 192.168.1.123 Of 80 Ports and 110 and 25 Packets from other ports than  
tcpdump -i eth1 host 192.168.1.123 and ! port 80 and ! port 25 and ! port 110
-w /tmp/xxx.cap

grab vlan 1 Bag of  
tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap

grab pppoe Password for  
tcpdump -i eth1 pppoes -w /tmp/xxx.cap

Use readable timestamps
tcpdump -tttt -i eth1

with 100m Size split save file , exceed 100m Open another file -C 100m

grab 10000 Exit after packages -c 10000

Grab greater than / less than N bytes Bag of
tcpdump -i eth1 greater 1024
tcpdump -i eth1 less 1024

Backstage bag grabbing , Console exit will not affect either ： 
nohup tcpdump -i eth1 port 110 -w /tmp/xxx.cap &

The captured documents can be used directly ethereal perhaps wireshark open .

Technology
©2020-2025 ioDraw All rights reserved, Privacy Policy