This is an old revision of the document!

Unsorted stuff goes here I guess

Some simple usage:

all packets arriving at or departing from # tcpdump -n host

To print traffic between and either or # tcpdump -n host and \( or \)

To print all IP packets between and any host except # tcpdump ip -n host and not

To print all traffic between local hosts and hosts at Berkeley: # tcpdump net ucb-ether

To print all ftp traffic through internet gateway xx: # tcpdump 'gateway xx and (port ftp or ftp-data)'

To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net). # tcpdump ip and not net localnet

To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host. # tcpdump 'tcp[13] & 3 != 0 and not src and dst net localnet'

To print IP packets longer than 576 bytes sent through gateway xx: # tcpdump 'gateway xx and ip[2:2] > 576'

To print IP broadcast or multicast packets that were not sent via ethernet broadcast or multicast: # tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'

To print all ICMP packets that are not echo requests/replies (i.e., not ping packets): # tcpdump 'icmp[0] != 8 and icmp[0] != 0“

Unsorted links

You found something interesing on the net and you don't know where to put it?? This is the place!

misc.1234793574.txt.gz · Last modified: 2009/05/25 00:34 (external edit)
CC Attribution-Share Alike 4.0 International
Driven by DokuWiki Recent changes RSS feed Valid CSS Valid XHTML 1.0 ipv6 ready