Using tcpdump

The tcpdump utility is used to read either packets captured live from a network or packets that have been saved to a file. Although there is a Windows version called windump, tcpdump only works on Unix-like operating systems.

Examples of Using tcpdump

Use this command to capture traffic on all interfaces:

# tcpdump -i any

Here is the command to capture traffic on a particular interface:

# tcpdump -i eth0

And to filter traffic by IP, whether it’s the source or the destination, use this command:

# tcpdump host 192.168.5.5