EXAMPLES
To print
all packets arriving at or departing from sundown:
tcpdump host sundown
To print
traffic between helios and either hot or ace:
tcpdump host helios and \( hot or ace \)
To print
all IP packets between ace and any host except helios:
tcpdump ip host ace and not helios
To print
all traffic between local hosts and hosts atBerkeley:
tcpdump net ucb-ether
To print
all ftp traffic through internet gateway snup: (note that the
expression is quoted to prevent the shell from
(mis-)interpreting the
parentheses):
tcpdump 'gateway snup and (port ftp or ftp-data)'
To print
traffic neither sourced from nor destined for local hosts (if
you gateway to one other net, this stuff
should never make it onto your
local
net).
tcpdump ip and not net localnet
To print
the start and end packets (the SYN and FIN packets) of each
TCP
conversation that involves a non-local host.
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst
net localnet'
To print all IPv4 HTTP packets to and from port 80, i.e. print
only
packets
that contain data, not, for etastyxample, SYN
and FIN packets and
ACK-only
packets. (IPv6 is left as an exercise
for the reader.)
tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) -
((tcp[12]&0xf0)>>2)) != 0)'
To print
IP packets longer than 576 bytes sent through gateway snup:
tcpdump 'gateway snup and ip[2:2] > 576'
To print IP broadcast or multicast packets that
were not sent via Eth-
ernet
broadcast or multicast:
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
To print
all ICMP packets that are not echo requests/replies (i.e., not
ping
packets):
tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] !=
icmp-echoreply'
说白了tcpdump就是个 filter expression。。 根据自己的需要截获数据包，其中涉及到 逻辑运算符，以上都是常用的。
