Help with TCPDump commands.

Posted on 2009-02-23
Medium Priority
Last Modified: 2013-12-23
Dear experts,

I would like to use tcpdump to capture all the traffic between my pc and the target host.

I know that the tcpdump it will capture all traffic from the source that I will specify such as eth0

The question: I want the tcpdump to go and connect to target host and save all packets that received from the host in a file for a further analysis ? Can I do that with tcpdump or the tcpdump can not go and interact with target host ?

If the tcpdump can not go and interact with other hosts, what is the best way to do that interaction with target hosts and then save all packets between us and hosts.

I will be happy for any answers and suggestions.
Thanks in advance.
Best regards.
Question by:Tree_PRO
  • 2
  • 2
LVL 18

Accepted Solution

deimark earned 2000 total points
ID: 23713699
In short, no, tcpdump will not do what you want.

tcpdump is a tool to monitor (save to file) the packets coming in and out of your interface(s).

What you can do, is start the capture for your specific traffic, use another console or application to generate the traffic.  Once complete, stop the tcpdump and then review the results.

An example would be as follows to capture all traffic going to and from host on interface eth0 and send to a file called "dumpfile"

tcpdump -i eth0 host > dumpfile
tcpdump -i eth0 host -w dumpfile

A handy page for all tcpdump commands is:


Author Comment

ID: 23713759
Dear deimark,

Thanks for the reply, useful and short.

In this sitation, I would use another tool to interact with the host, the work will be like this:
1- run tcpdum and save all data to file
2- interact to host by another tool
3- stop tcpdump from capturing data.

About the point 3 , stop the tcpdump after finish from interact, is there any way to do that from the command line for example:
>tcpdump - (stop)

Or I have to stop it manually by control and C.

LVL 18

Expert Comment

ID: 23713879
When you run tcpdump, it will run in the console session you started it from.  It will also give a live packet count to give you an idea if its working or not.

To stop it, I'm afraid the only way is to hit Ctrl-C as you said.


Author Comment

ID: 23713901
Thanks man for helping me :)


Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Fine Tune your automatic Updates for Ubuntu / Debian
Originally, this post was published on Monitis Blog, you can check it here . It goes without saying that technology has transformed society and the very nature of how we live, work, and communicate in ways that would’ve been incomprehensible 5 ye…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question