tcpdump

Capture All traffic

tcpdump -i eth0

Save Captured Traffic to a File

tcpdump -i eth0 -w capture.pcap

Display Captured Traffic

tcpdump -r capture.pcap

Filter

# Filter by Source IP
tcpdump src 192.168.0.1

# Filter by Destination IP
tcpdump dst 192.168.0.1

# Filter by Port
tcpdump port 80

# Filter by Protocol
tcpdump icmp

Display Traffic in ASCII

# Dispaly in ASCII
tcpdump -A

# Display in Hexadecimal
tcpdump -X

Filter

 

 

 

Monitor SSH connections

# -l: real-time
# -e: including ethernet headers
tcpdump -i eth0 'tcp port 22' -l -e