tcpdump
Dump traffic on a network.
More information: https://www.tcpdump.org.
- List available network interfaces:
tcpdump -D
- Capture the traffic of a specific interface:
tcpdump -i eth0
- Capture all TCP traffic showing contents (ASCII) in console:
tcpdump -A tcp
- Capture the traffic from or to a host:
tcpdump host www.example.com
- Capture the traffic from a specific interface, source, destination and destination port:
tcpdump -i eth0 src 192.168.1.1 and dst 192.168.1.2 and dst port 80
- Capture the traffic of a network:
tcpdump net 192.168.1.0/24
- Capture all traffic except traffic over port 22 and save to a dump file:
tcpdump -w dumpfile.pcap port not 22
- Read from a given dump file:
tcpdump -r dumpfile.pcap