The command parameter to save the capture package to the file is -w xxx.cap
grab eth1 Bag of
tcpdump -i eth1 -w /tmp/xxx.cap
grab 192.168.1.123 Bag of
tcpdump -i eth1 host 192.168.1.123 -w /tmp/xxx.cap
grab 192.168.1.123 Of 80 Packets for port
tcpdump -i eth1 host 192.168.1.123 and port 80 -w /tmp/xxx.cap
The target address is 192.168.1.123 Of 80 Packets for port
tcpdump -i eth1 dst 192.168.1.123 and port 80 -w /tmp/xxx.cap
grab 192.168.1.123 Of icmp Bag of
tcpdump -i eth1 host 192.168.1.123 and icmp -w /tmp/xxx.cap
grab eth1 wrong arp,rarp Bag of
tcpdump -i eth1 not arp and not rarp
Display in packet capture log IP, No IP analysis
tcpdump -i eth1 -n
grab 192.168.1.123 Of 80 Ports and 110 and 25 Packets from other ports than
tcpdump -i eth1 host 192.168.1.123 and ! port 80 and ! port 25 and ! port 110
-w /tmp/xxx.cap
grab vlan 1 Bag of
tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap
grab pppoe Password for
tcpdump -i eth1 pppoes -w /tmp/xxx.cap
Use readable timestamps
tcpdump -tttt -i eth1
with 100m Size split save file , exceed 100m Open another file -C 100m
grab 10000 Exit after packages -c 10000
Grab greater than / less than N bytes Bag of
tcpdump -i eth1 greater 1024
tcpdump -i eth1 less 1024
Backstage bag grabbing , Console exit will not affect either ：
nohup tcpdump -i eth1 port 110 -w /tmp/xxx.cap &
The captured documents can be used directly ethereal perhaps wireshark open .
Technology