Linux packet capture command (learning)

The command parameter for saving tcpdump packets to a file is-w xxx. Cap.

Capture the eth1 package
Tcpdump-I eth1-W/tmp/xxx. Cap

Capture the packet of 192.168.1.123
Tcpdump-I eth1 host 192.168.1.123-W/tmp/xxx. Cap

Capture port 80 of 192.168.1.123
Tcpdump-I eth1 host 192.168.1.123 and port 80-W/tmp/xxx. Cap

Capture the ICMP packet of 192.168.1.123
Tcpdump-I eth1 host 192.168.1.123 and ICMP-W/tmp/xxx. Cap

Capture packets of port 80 of 192.168.1.123 and ports other than 110 and 25
Tcpdump-I eth1 host 192.168.1.123 and! Port 80 and! Port 25 and! Port 110-W/tmp/xxx. Cap

Capture VLAN 1 packets
Tcpdump-I eth1 port 80 and VLAN 1-W/tmp/xxx. Cap

Capture pppoe Password
Tcpdump-I eth1 pppoes-W/tmp/xxx. Cap

Save the file in 100 MB, and open a file larger than MB-C MB

Capture 10000 packets and exit-C 10000

Packet capture in the background, and the exit of the console will not be affected:
Nohup tcpdump-I eth1 port 110-W/tmp/xxx. Cap &

You can use ethereal or Wireshark to open the captured file. Wireshark is the new ethereal,ProgramRenamed