tcpdump: Some filter examples

Hi,

here are some command line examples for often requested packet filter strings

Filter for a MAC address

tcpdump ether host 12:34:56:78:90:ab

Layer 2 broadcasts

tcpdump ether dst ff:ff:ff:ff:ff:ff

Filter icmp packets. For example on interface eth0

tcpdump -i eth0 icmp

All packets to or from a TCP port

tcpdump -i eth0 port 22

All packets to or from an IP Address

tcpdump -i eth0 host 10.10.254.10

And combined

tcpdump -i eth0 host 10.10.254.10 and port 22

Filter for the TCP Flags SYN or FIN

tcpdump tcp[tcpflags] & (tcp-syn|tcp-fin) != 0

Filter for Packets where SYN and ACK is set

tcpdump tcp[tcpflags] & tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)

Michael

Futher details could be found in the pcap man page.

Advertisment to support michlstechblog.info

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.