Linux Networking Cookbook

19.7. Using tcpdump to Capture and Analyze Traffic

Problem

You really need to see what's going over the wires, and you know that tcpdump is just the powerhouse packet sniffer you want. But, you don't know how to filter all those masses of traffic. How do you make it show only what you want to see?

Solution

tcpdump can filter your traffic as precisely as you like. Just follow these examples to learn the more commonly used filters.

You should routinely use the -p switch to prevent the interface from going into promiscuous mode because promiscuous mode is pretty much useless on switched networks.

Capture all traffic on a single host:

	# tcpdump -pi eth0 host uberpc

Capture all traffic on more than one host:

	# tcpdump -pi eth0 host uberpc and stinkpad and penguina

Capture all traffic on more than one host, except from a specified host:

	# tcpdump -pi eth0 host uberpc and stinkpad and not penguina

Capture traffic going to a host:

	# tcpdump -pi eth0 dst host uberpc

Capture traffic leaving a host:

	# tcpdump -pi eth0 src host uberpc

Capture a single protocol:

	# tcpdump -pi eth0 tcp

Capture more than one protocol:

	# tcpdump -pi eth0 tcp or udp or icmp

Capture a specific port:

	# tcpdump -pi eth0 port 110

Capture several ports:

	# tcpdump -pi eth0 port 25 or port 80 or port 110

Capture a port range:

	# tcpdump -pi eth0 portrange 3000-4000

Watch traffic leaving a port:

	# tcpdump -pi eth0 src port 110

Watch traffic entering a port:

	# tcpdump -pi eth0 dst port 110

Look for packets smaller than the specified size: ...