Limit capture count tcpdump
Stop after capturing 100 packets
tcpdump -i eth0 -c 100 -w capture.pcap
more tcpdump
all 18 commands →
Capture only TCP SYN packets
tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'
Capture SYN and FIN flags
tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'
Host filter excluding SSH noise
tcpdump -nn -i any host <ip> and not port 22
Full payload hex+ascii dump
tcpdump -nn -s 0 -X -i any port <port>
Ring buffer capture by size
tcpdump -nn -i any -s 0 -C 100 -W 5 -w /tmp/cap.pcap