Linux tcpdump capture command

  
 

tcpdump -i eth0 -c 500 -w xxxeth0.cap

-i eth1 only grabs data from eth1 port -c 500 represents the number of packets, that is, only 500 packets -w Xxxeth0.cap is saved as a cap file for easy analysis with ethereal or Wireshark

Only grab the 80-port packet and save it as a cap package

tcpdump -i eth0 port 80 -w /tmp/Xxx.cap

Filter out port 22 and save it as a cap package

tcpdump -i eth0 port not 22 -w xxxeth0.cap

Copyright © Windows knowledge All Rights Reserved