<h1 id="regular-tcpdump">Regular TCPDUMP</h1>
<p>Since tcpdump is installed by default, it's the first thing to use</p>
<pre><code class="language-bash"># Only listen on one interface
tcpdump -i &#x3C;interface/any>

# Filter to a host
tcpdump 'host &#x3C;ip address/fqdn>'

# filter to a port
tcpdump 'tcp port 5000'

# combine filters
tcpdump '(tcp port 5000 or tcp port 35357) and host 192.168.0.100'

# print packets in ascii (basically always want this)
tcpdump -A

</code></pre>
<h1 id="using-tshark">Using tshark</h1>
<p>Another option is wireshark's command line, tshark:</p>
<pre><code class="language-bash">apt-get install tshark
</code></pre>
<p>Note that tshark is really slow to get started compared to tcpdump, you need to wait a good while
until it says something like "Capturing on 'eno1'"</p>
<pre><code class="language-bash"># show interfaces
tshark -D

# Capture everything from a given source and interface
tshark -i eno1 -Y "ip.src == 10.1.0.76"

# Capture HTTP to and from a given source
tshark -i eno1 -Y "ip.addr == 10.1.0.76 and http"
</code></pre>


Kyle Pericak

"It works in my environment"

Categories

Tags