Check out my first novel, midnight's simulacra!

Tcpdump: Difference between revisions

From dankwiki
No edit summary
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
==Important flags==
* <tt>-n</tt> to disable (per-packet blocking) DNS lookups
* <tt>-s snaplen</tt> to capture more than the default snapshot length. 0 for no limit.
* <tt>-e</tt> to show link-layer information
==Recipes==
==Recipes==
* Capture all arp: '''tcpdump arp -n -s0'''
* Capture all arp: '''tcpdump arp'''
* Capture packets to or from a MAC address M: '''tcpdump ether host M'''
==Gotchas==
* <tt>tcpdump</tt> will not function on a [[DPDK]] interface once a DPDK application has bound the interface
* A filter matching L4 fields (including [[TCP]]/[[UDP]] port) will not match any fragments save the first. Watch for <tt>[+]</tt> to indicate more fragments.

Latest revision as of 07:52, 8 January 2021

Important flags

  • -n to disable (per-packet blocking) DNS lookups
  • -s snaplen to capture more than the default snapshot length. 0 for no limit.
  • -e to show link-layer information

Recipes

  • Capture all arp: tcpdump arp
  • Capture packets to or from a MAC address M: tcpdump ether host M

Gotchas

  • tcpdump will not function on a DPDK interface once a DPDK application has bound the interface
  • A filter matching L4 fields (including TCP/UDP port) will not match any fragments save the first. Watch for [+] to indicate more fragments.