Filter an existing pcap offline tcpdump

Re-filter a saved capture without re-running it; BPF applies on read

tcpdump -nn -r /tmp/cap.pcap 'port 443 and host <ip>'

#tcpdump #debug #tls #troubleshooting

more tcpdump all 18 commands →

DNS query capture with link header tcpdump -nn -e -i any port 53 Capture on interface tcpdump -i eth0 -n Capture to file tcpdump -i eth0 -w /tmp/capture.pcap Read PCAP file tcpdump -r /tmp/capture.pcap -n | head -50 Filter by host tcpdump -i any host 10.0.0.5 -n