Use the tcpdump command

1. Capture packets containing 10.10.122
# Tcpdump-I eth0-vnn host 10.10.122


2. Capture packets containing 10.10.10.0/24 network segments
# Tcpdump-I eth0-vnn net 10.10.10.0/24


3. capture data packets containing port 22
# Tcpdump-I eth0-vnn port 22


4. Capture UDP Packets
# Tcpdump-I eth0-vnn UDP


5. Capture ICMP data packets
# Tcpdump-I eth0-vnn ICMP
6. Capture ARP packets
# Tcpdump-I eth0-vnn ARP


7. Capture IP protocol data packets
# Tcpdump-I eth0-vnn IP


8. capture data packets whose source IP address is 10.10.122.
# Tcpdump-I eth0-vnn SRC host 10.10.122


9. capture data packets whose destination IP address is 10.10.122
# Tcpdump-I eth0-vnn DST host 10.10.122


10. capture data packets whose source port is 22
# Tcpdump-I eth0-vnn SRC port 22


11. capture data packets whose source IP address is 10.10.253 and the destination IP address is 22.
# Tcpdump-I eth0-vnn SRC host 10.10.253 and DST port 22

12. capture data packets whose source IP address is 10.10.122 or whose port is 22
# Tcpdump-I eth0-vnn SRC host 10.10.122 or port 22


13. capture data packets whose source IP address is 10.10.122 and whose port is not 22
[[Email protected] FTP] # tcpdump-I eth0-vnn SRC host 10.10.122 and not port 22
 
14. capture data packets whose source IP address is 10.10.10.2 and the destination port is 22, or whose source IP address is 10.10.10.65 and the destination port is 80.
# Tcpdump-I eth0-vnn \ (SRC host 10.10.10.2 and DST port 22 \) or \ (SRC host 10.10.65 and DST port 80 \)


15. capture data packets whose source IP address is 10.10.10.59 and the destination port is 22, or whose source IP address is 10.10.10.68 and the destination port is 80.
[[Email protected] ~] # Tcpdump-I eth0-vnn 'src host 10.10.10.59 and DST port 22 'or 'src host 10.10.10.68 and DST port 80'


16. Save the captured data packet records to the/tmp/fill file. After capturing 100 data packets, exit the program.
# Tcpdump-I eth0-vnn-W/tmp/fil1-C 100


17. Read TCP packets from/tmp/fill records
# Tcpdump-I eth0-vnn-r/tmp/fil1 TCP


18. Read data packets containing 10.10.10.58 from the/tmp/fill record
# Tcpdump-I eth0-vnn-r/tmp/fil1 host 10.10.10.58

This article is from the "I Am a laruence" blog, please be sure to keep this source http://2242558.blog.51cto.com/2232558/1545317

Use the tcpdump command