Tcpdump howto
capturing
Changing packet size in the capture file:
By default, when capturing packets into a file, it will save only 68 bytes of the data from each packet. The -s command line switch tells tcpdump how many bytes for each packet to save. Specifying 0 as a packet’s snapshot length tells tcpdump to save whole packet.
example: tcpdump -w file.cap -s 0
UNIX tcpdump 3.9.4(Freebsd, ipso)
Showing link level headers (MAC addresses)
tcpdump -e -i ethxxx
filtering for specific sources and destinations
tcpdump -nnei eth1-01 '((host 192.168.1.1 and host 172.16.0.1) or (host 10.0.0.1 and host 172.16.0.1))'
filtering based on TCP flags
tcpdump -nnei eth0 'tcp[tcpflags] & tcp-rst != 0'
gentoo output file
On gentoo, the output file sometimes goes where it wants to, instead of where I tell it with the -o option. That location is...
default location /var/lib/tcpdump/
reading tcpdump captures
It is a pain sometimes to transfer tcpdump to another device for viewing in Wireshark or other utilities. The same filters that apply to capturing can be applied to reading the tcpdump capture file.
# tcpdump -r <path to file>
showing the data portion of a packet
# tcpdump -X -r <path to file>
double X will also display the link level headers
-XX