Capture between two hosts tcpdump
BPF filter: traffic between exactly two endpoints
tcpdump -i eth0 'host 10.0.0.1 and host 10.0.0.2'
more tcpdump
all 18 commands →
Verbose with packet content
tcpdump -i eth0 -vvv -A -s 0 port 5432
Limit capture count
tcpdump -i eth0 -c 100 -w capture.pcap
Capture only TCP SYN packets
tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'
Capture SYN and FIN flags
tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'
Host filter excluding SSH noise
tcpdump -nn -i any host <ip> and not port 22