====== TCPDump Examples ======
From: [[http://www.rationallyparanoid.com/articles/tcpdump.html]]


See the list of interfaces on which tcpdump can listen:
<file>tcpdump -D</file>

Listen on interface eth0:
<file>tcpdump -i eth0</file>

Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater):
<file>tcpdump -i any</file>

Be verbose while capturing packets:
<file>tcpdump -v</file>

Be more verbose while capturing packets:
<file>tcpdump -vv</file>

Be very verbose while capturing packets:
<file>tcpdump -vvv</file>

Be less verbose (than the default) while capturing packets:
<file>tcpdump -q</file>

Limit the capture to 100 packets:
<file>tcpdump -c 100</file>

Record the packet capture to a file called capture.cap:
<file>tcpdump -w capture.cap</file>

Record the packet capture to a file called capture.cap but display on-screen how many packets have been captured in real-time:
<file>tcpdump -v -w capture.cap</file>

Display the packets of a file called capture.cap:
<file>tcpdump -r capture.cap</file>

Display the packets using maximum detail of a file called capture.cap:
<file>tcpdump -vvv -r capture.cap</file>

Display IP addresses and port numbers instead of domain and service names when capturing packets:
<file>tcpdump -n</file>

Capture any packets where the destination host is 192.168.1.1. Display IP addresses and port numbers:
<file>tcpdump -n dst host 192.168.1.1</file>

Capture any packets where the source host is 192.168.1.1. Display IP addresses and port numbers:
<file>tcpdump -n src host 192.168.1.1</file>

Capture any packets where the source or destination host is 192.168.1.1. Display IP addresses and port numbers:
<file>tcpdump -n host 192.168.1.1</file>

Capture any packets where the destination network is 192.168.1.0/24. Display IP addresses and port numbers:
<file>tcpdump -n dst net 192.168.1.0/24</file>

Capture any packets where the source network is 192.168.1.0/24. Display IP addresses and port numbers:
<file>tcpdump -n src net 192.168.1.0/24</file>

Capture any packets where the source or destination network is 192.168.1.0/24. Display IP addresses and port numbers:
<file>tcpdump -n net 192.168.1.0/24</file>

Capture any packets where the destination port is 23. Display IP addresses and port numbers:
<file>tcpdump -n dst port 23</file>

Capture any packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:
<file>tcpdump -n dst portrange 1-1023</file>

Capture only TCP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:
<file>tcpdump -n tcp dst portrange 1-1023</file>

Capture only UDP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:
<file>tcpdump -n udp dst portrange 1-1023</file>

Capture any packets with destination IP 192.168.1.1 and destination port 23. Display IP addresses and port numbers:
<file>tcpdump -n "dst host 192.168.1.1 and dst port 23"</file>

Capture any packets with destination IP 192.168.1.1 and destination port 80 or 443. Display IP addresses and port numbers:
<file>tcpdump -n "dst host 192.168.1.1 and (dst port 80 or dst port 443)"</file>

Capture any ICMP packets:
<file>tcpdump -v icmp</file>

Capture any ARP packets:
<file>tcpdump -v arp</file>

Capture either ICMP or ARP packets:
<file>tcpdump -v "icmp or arp"</file>

Capture any packets that are broadcast or multicast:
<file>tcpdump -n "broadcast or multicast"</file>

Capture 500 bytes of data for each packet rather than the default of 68 bytes:
<file>tcpdump -s 500</file>

Capture all bytes of data within the packet:
<file>tcpdump -s 0</file>