Filter by host tcpdump
Capture only traffic to/from a specific IP
tcpdump -i any host 10.0.0.5 -n
more tcpdump
all 18 commands →
Filter by port
tcpdump -i eth0 port 443 -n
Capture DNS queries
tcpdump -i any -n port 53
Show HTTP GET requests
tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /'
Capture between two hosts
tcpdump -i eth0 'host 10.0.0.1 and host 10.0.0.2'
Verbose with packet content
tcpdump -i eth0 -vvv -A -s 0 port 5432