Tcpdump: Difference between revisions
| Line 1: | Line 1: | ||
==Important flags== | |||
* <tt>-n</tt> to disable (per-packet blocking) DNS lookups | |||
* <tt>-s snaplen</tt> to capture more than the default snapshot length. 0 for no limit. | |||
==Recipes== | ==Recipes== | ||
* Capture all arp: '''tcpdump arp | * Capture all arp: '''tcpdump arp''' | ||
* Capture packets to or from a MAC address M: '''tcpdump "ether host M''' | |||