Tcpdump Filters Cheat Sheet

The TCPdump Filters Cheat Sheet is a reference document that provides a quick and easy guide to using filters with the TCPdump tool. It helps users efficiently capture and analyze network traffic based on specific criteria such as source/destination IP addresses, protocol types, port numbers, and more.

The TCPdump Filters Cheat Sheet is not filed by any particular organization or individual. It is a freely available resource created and contributed by the open-source community for the benefit of users.

FAQ

Q: What is tcpdump?
A: Tcpdump is a command-line network packet capture tool.

Q: How can I capture packets with tcpdump?
A: You can use tcpdump with a specified network interface or read packets from a pcap file.

Q: What are tcpdump filters?
A: Tcpdump filters are used to specify the criteria to capture specific packets.

Q: How can I filter packets by source IP address?
A: You can use the filter 'src host <IP>' to capture packets from a specific source IP address.

Q: How can I filter packets by destination IP address?
A: You can use the filter 'dst host <IP>' to capture packets destined for a specific IP address.

Q: How can I filter packets by port number?
A: You can use the filter 'port <port_number>' to capture packets with a specific source or destination port.

Q: How can I capture both incoming and outgoing packets?
A: You can use the filter 'src host <IP> or dst host <IP>' to capture packets involving a specific IP address.

Q: How can I filter packets by protocol?
A: You can use the filter 'proto <protocol>' to capture packets of a specific protocol, such as TCP or UDP.

Q: Can tcpdump capture only a specific number of packets?
A: Yes, you can specify the number of packets to capture using the '-c' option.

Q: How can I save the captured packets to a file?
A: You can use the '-w' option followed by a filename to save the captured packets to a file.