In Linux, how does one use tcpdump to capture packets ?, Linuxtcpdump

In Linux, how does one use tcpdump to capture packets ?, Linuxtcpdump
In Linux, how does one use tcpdump to capture packets?

Most of the time, our system is deployed on the Linux system. In some cases, to locate the problem, you need to check whether the data packets sent between systems are normal. Next I will explain how to use tcpdump to capture packets.

Tcpdump is an open-source packet capture tool in Linux. Like wireshark in Windows, tcpdump supports capturing data of specified network ports, specified destination addresses, specified source addresses, specified ports, and specified protocols.

1. Install tcpdump

yum install -y tcpdump

2. Common usage

Capture all network data that passes through eth2 destination or source address 192.168.1.2 and save it to the XX. pcap file tcpdump-I eth2 host 192.168.1.2-w xx. pcap

Capture all network data passing through eth2 with the destination address 192.168.1.2 and save it to the XX. pcap file.

tcpdump   -i  eth2  dst host 192.168.1.2    -w   xx.pcap

Capture all network data passing through eth1 with the source address 192.168.1.2 and save it to the XX. pcap file.

tcpdump   -i  eth2  dst host 192.168.1.2    -w   xx.pcap

? Capture the data that the source port of network port 1 is 25 and save it to xx. pcap # tcpdump-I eth1 src port 25-w xx. pcap

Capture the data of port 25 of network port 1 and save it to xx. pcap.

# Tcpdump-I eth1 dst port 25-w xx. pcap