Description :
tcpdump is a common packet sniffer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.
Examples:
tcpdump -i -s 1500 eth0 192.168.1.0/24 -w tmp/xxx.pcap
eth0 is the interface name is the interface sets on your device. If you want to filter based on the network address, you should put as above, if filter based on host, change it to ‘host 192.168.1.0′. The -s 1500 indicate the normal 1500 size packet you want to capture. If you don’t define 1500, the packets captured will show incomplete details.-w is used to save the files to a specific folder. By defining the file extension with .pcap, you’d be able to double click the file to open it via ethernet
To print all packets arriving at or departing from sundown:
tcpdump host sundown
tcpdump host sundown -i eth2
tcpdump -w test.pcap -i eth2 tcp port 6881
tcpdump -w test.pcap -i eth1 tcp port 6881 or udp \( 33210 or 33220 \
To print traffic between helios and either hot or ace:
tcpdump host helios and \( hot or ace \)
To print all IP packets between ace and any host except helios:
tcpdump ip host ace and not helios
To print all traffic between local hosts and hosts at Berkeley:
tcpdump net ucb-ether
To print all ftp traffic through internet gateway snup: (note that the
expression is quoted to prevent the shell from (mis-)interpreting the
parentheses):
tcpdump ‘gateway snup and (port ftp or ftp-data)’
To print traffic neither sourced from nor destined for local hosts (if
you gateway to one other net, this stuff should never make it onto your
local net).
tcpdump ip and not net localnet
To print the start and end packets (the SYN and FIN packets) of each
TCP conversation that involves a non-local host.
tcpdump ‘tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet’
To print all IPv4 HTTP packets to and from port 80, i.e. print only
packets that contain data, not, for example, SYN and FIN packets and
ACK-only packets. (IPv6 is left as an exercise for the reader.)
tcpdump ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’
To print IP packets longer than 576 bytes sent through gateway snup:
tcpdump ‘gateway snup and ip[2:2] > 576′
To print IP broadcast or multicast packets that were not sent via Eth-
ernet broadcast or multicast:
tcpdump ‘ether[0] & 1 = 0 and ip[16] >= 224′
To print all ICMP packets that are not echo requests/replies (i.e., not
ping packets):
tcpdump ‘icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply’
