Capture on interface tcpdump

Capture to file tcpdump -i eth0 -w /tmp/capture.pcap Read PCAP file tcpdump -r /tmp/capture.pcap -n | head -50 Filter by host tcpdump -i any host 10.0.0.5 -n Filter by port tcpdump -i eth0 port 443 -n Capture DNS queries tcpdump -i any -n port 53