May 2017
Beginner
552 pages
28h 47m
English
If you are trying to track web usage on your network, you may only need to see the packets generated on your site. The src modifier specifies only these packets, with given values, in the source file. The dst modifier specifies only the destination:
$ tcpdump -r /tmp/tcpdump.raw src port http reading from file /tmp/tcpdump.raw, link-type EN10MB (Ethernet) 10:36:50.586007 IP ord38s04-in-f3.1e100.net.http > 192.168.1.44.59152: Flags [.], ack 1, win 350, options [nop,nop,TS val 3010640112 ecr 2061270277], length 0 10:36:50.586035 IP ord38s04-in-f3.1e100.net.http > 192.168.1.44.59150: Flags [.], ack 1, win 350, options [nop,nop,TS val 3010385005 ecr 2061270277], length 0