https://wiki.ixheim.de/index.php?action=history&feed=atom&title=Tcpdump-cheat-sheet
Tcpdump-cheat-sheet - Versionsgeschichte
2026-05-15T02:03:38Z
Versionsgeschichte dieser Seite in Xinux Wiki
MediaWiki 1.35.1
https://wiki.ixheim.de/index.php?title=Tcpdump-cheat-sheet&diff=62163&oldid=prev
Thomas.will am 23. April 2025 um 11:23 Uhr
2025-04-23T11:23:16Z
<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="de">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 23. April 2025, 11:23 Uhr</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l52" >Zeile 52:</td>
<td colspan="2" class="diff-lineno">Zeile 52:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump 'tcp[13] == tcp-syn'</code> || capture TCP SYN packets</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump 'tcp[13] == tcp-syn'</code> || capture TCP SYN packets</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump 'tcp[13] & (tcp-syn|tcp-fin) != 0'</code> || match TCP SYN or FIN</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump 'tcp[13] <ins class="diffchange diffchange-inline"><nowiki> </ins>& (tcp-syn|tcp-fin) != 0'<ins class="diffchange diffchange-inline"></nowiki></ins></code> || match TCP SYN or FIN</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -e vlan 10</code> || capture traffic with VLAN tag 10</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -e vlan 10</code> || capture traffic with VLAN tag 10</div></td></tr>
<!-- diff cache key my_wiki:diff::1.12:old-62162:rev-62163 -->
</table>
Thomas.will
https://wiki.ixheim.de/index.php?title=Tcpdump-cheat-sheet&diff=62162&oldid=prev
Thomas.will am 23. April 2025 um 11:22 Uhr
2025-04-23T11:22:19Z
<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="de">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 23. April 2025, 11:22 Uhr</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l10" >Zeile 10:</td>
<td colspan="2" class="diff-lineno">Zeile 10:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump tcp</code> || capture only <del class="diffchange diffchange-inline">a specific protocol (e.g. ICMP)</del></div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump tcp</code> || capture only <ins class="diffchange diffchange-inline">tcp</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">|-</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">| <code>tcpdump udp</code> || capture only udp</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">|-</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">| <code>tcpdump icmp</code> || capture only icmp</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">|-</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">| <code>tcpdump arp</code> || capture only arp</ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td></tr>
<!-- diff cache key my_wiki:diff::1.12:old-62161:rev-62162 -->
</table>
Thomas.will
https://wiki.ixheim.de/index.php?title=Tcpdump-cheat-sheet&diff=62161&oldid=prev
Thomas.will am 23. April 2025 um 11:21 Uhr
2025-04-23T11:21:07Z
<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="de">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 23. April 2025, 11:21 Uhr</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l10" >Zeile 10:</td>
<td colspan="2" class="diff-lineno">Zeile 10:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump tcp<del class="diffchange diffchange-inline">|udp|icmp|arp</del></code> || capture only a specific protocol (e.g. ICMP)</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump tcp</code> || capture only a specific protocol (e.g. ICMP)</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td></tr>
<!-- diff cache key my_wiki:diff::1.12:old-62160:rev-62161 -->
</table>
Thomas.will
https://wiki.ixheim.de/index.php?title=Tcpdump-cheat-sheet&diff=62160&oldid=prev
Thomas.will am 23. April 2025 um 11:20 Uhr
2025-04-23T11:20:46Z
<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="de">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 23. April 2025, 11:20 Uhr</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l10" >Zeile 10:</td>
<td colspan="2" class="diff-lineno">Zeile 10:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump <del class="diffchange diffchange-inline">[</del>tcp|udp|icmp|arp<del class="diffchange diffchange-inline">]</del></code> || capture only a specific protocol (e.g. ICMP)</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump tcp|udp|icmp|arp</code> || capture only a specific protocol (e.g. ICMP)</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td></tr>
<!-- diff cache key my_wiki:diff::1.12:old-62159:rev-62160 -->
</table>
Thomas.will
https://wiki.ixheim.de/index.php?title=Tcpdump-cheat-sheet&diff=62159&oldid=prev
Thomas.will am 23. April 2025 um 11:20 Uhr
2025-04-23T11:20:29Z
<p></p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="de">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 23. April 2025, 11:20 Uhr</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l10" >Zeile 10:</td>
<td colspan="2" class="diff-lineno">Zeile 10:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump -i any</code> || capture packets from all available interfaces</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump <del class="diffchange diffchange-inline">arp|</del>tcp|udp|icmp</code> || capture only a specific protocol</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump <ins class="diffchange diffchange-inline">[</ins>tcp|udp|icmp<ins class="diffchange diffchange-inline">|arp]</ins></code> || capture only a specific protocol <ins class="diffchange diffchange-inline">(e.g. ICMP)</ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|-</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1</div></td></tr>
<!-- diff cache key my_wiki:diff::1.12:old-62158:rev-62159 -->
</table>
Thomas.will
https://wiki.ixheim.de/index.php?title=Tcpdump-cheat-sheet&diff=62158&oldid=prev
Thomas.will: Die Seite wurde neu angelegt: „{| class="wikitable sortable" ! Befehl !! Beschreibung |- | <code>tcpdump</code> || listen on the first non-loopback interface detected |- | <code>tcpdump -i e…“
2025-04-23T11:14:25Z
<p>Die Seite wurde neu angelegt: „{| class="wikitable sortable" ! Befehl !! Beschreibung |- | <code>tcpdump</code> || listen on the first non-loopback interface detected |- | <code>tcpdump -i e…“</p>
<p><b>Neue Seite</b></p><div>{| class="wikitable sortable"<br />
! Befehl !! Beschreibung<br />
|-<br />
| <code>tcpdump</code> || listen on the first non-loopback interface detected<br />
|-<br />
| <code>tcpdump -i eth0</code> || capture packets on eth0 and display their content<br />
|-<br />
| <code>tcpdump -i eth0 -w my.pcap</code> || save packets received on eth0 to my.pcap<br />
|-<br />
| <code>tcpdump -i any</code> || capture packets from all available interfaces<br />
|-<br />
| <code>tcpdump arp|tcp|udp|icmp</code> || capture only a specific protocol<br />
|-<br />
| <code>tcpdump src 10.0.0.1</code> || capture traffic from 10.0.0.1<br />
|-<br />
| <code>tcpdump port 80</code> || capture traffic with either src/dst port 80<br />
|-<br />
| <code>tcpdump dst net 10.1.1.0/24</code> || capture traffic for specific subnet<br />
|-<br />
| <code>tcpdump tcp and src 10.0.0.1 and port 80</code> || combine multiple filters<br />
|-<br />
| <code>tcpdump tcp dst portrange 22-1023</code> || capture packets with port range<br />
|-<br />
| <code>tcpdump -vvv</code> || show protocol-specific info with full verbosity<br />
|-<br />
| <code>tcpdump -tt</code> || use UNIX timestamp as packet timestamp format<br />
|-<br />
| <code>tcpdump not port 22</code> || capture all traffic except ssh traffic<br />
|-<br />
| <code>tcpdump -c 1000</code> || capture the first 1000 packets only<br />
|-<br />
| <code>tcpdump -n</code> || do not convert IP addresses/ports to names<br />
|-<br />
| <code>tcpdump -e</code> || display layer-2 info such as MAC addresses<br />
|-<br />
| <code>tcpdump -X</code> || show payload content in hex/ASCII format<br />
|-<br />
| <code>tcpdump ip6</code> || capture IPv6 packets only<br />
|-<br />
| <code>tcpdump 'tcp port 80 or udp port 67'</code> || use complex filters<br />
|-<br />
| <code>tcpdump greater 200</code> || capture packets whose length > 200<br />
|-<br />
| <code>tcpdump ether dst ff:ff:ff:ff:ff:ff</code> || capture layer-2 broadcast packets<br />
|-<br />
| <code>tcpdump 'tcp[13] == tcp-syn'</code> || capture TCP SYN packets<br />
|-<br />
| <code>tcpdump 'tcp[13] & (tcp-syn|tcp-fin) != 0'</code> || match TCP SYN or FIN<br />
|-<br />
| <code>tcpdump -e vlan 10</code> || capture traffic with VLAN tag 10<br />
|-<br />
| <code>tcpdump 'icmp[0] = 8'</code> || capture ICMP echo request packets (ping)<br />
|-<br />
| <code>tcpdump outbound</code> || capture only outbound traffic<br />
|}</div>
Thomas.will