tcpdump
some common tcpdump cli
1 | # Reading / Writing Captures to a File |
Advanced
match MAC address & VLAN
- ether host
- capture packets sent from and to - ether src
- capture packets sent from - ether dst
- capture packets sent to - vlan
- match
match protocol
Match protocols in L3 header:
-
ip proto
- PROTO: icmp, icmp6, igmp, igrp, pim, ah, esp, vrrp, udp, or tcp
Follow are abbreviations:
-
icmp
=proto icmp
-
tcp
=proto tcp
-
udp
=proto udp
Match protocols in L2 header:
-
ether proto
- PROTO: ip, ip6, arp, rarp, atalk, aarp, decnet, sca, lat, mopdl, moprc, iso, stp, ipx, or netbeui
Follow are abbreviations:
-
ip
=ether proto ip
-
ip6
=ether proto ip6
-
arp
=ether proto arp
-
rarp
=ether proto rarp
1 | tcpdump -i eth0 arp |
Related Posts