Packet Capture via TCPDump

To capture virtually any packet that enters any interface, you can use tcpdump. tcpdump is a complex
program, with many switches. This is the basic usage.
For more info, see http://linux.die.net/man/8/tcpdump

Synopsis
tcpdump [-n] [-i interface] [-w file] [-r file] [-s0] [-X] [-v] [expression]
-n
Show IP addresses, rather than hostnames
-i
Listen on interface
-w
Write to file in pcap format
-r
Read from pcap file
-s0
Show the whole packet, do not truncate
-X
Show both hex and ascii (helpful for looking at clear text errors)
-v
Show verbose output (use -vv and -vvv for more verbose output)
[expression]
You can use expressions to filter your query. see below for the most
commonly used.

not (!= or not)

and (&& or and)
or (|| or or)

host [ip | hostname] - filter for a specific host

port [port number] - filter for a specific port
icmp - only show ICMP packets (ping and traceroute for example)
and [not] [or] - you can use multiple expressions together with
these keywords.

Negation
Concatenation
Alternation

Examples
To print all packets from host 192.168.1.69 arriving at or departing on eth1 (shows only IP-addresses
and verbose output)

tcpdump veni eth1 host 192.168.1.69

To print all ICMP packets arriving at or departing on any interfaces

tcpdump veni any icmp

To print all packets from host 192.168.0.121 or 192.168.0.135 excluding traffic on port 22 and port
4444 arriving or departing on eth5 (important to exclude packets of the WebAdmin-session and SSH
itself)

tcpdump veni eth5 host 192.168.0.121 or 192.168.0.135 and not port 22 and not port 4444
To print all packets to and from port 80 arriving at or departing on eth0

tcpdump veni eth0 port 80

Advanced parameters
tcpdump
-A
-e
less xxx
greater xxx
-t
host
net
port
portrange
src
dst
src or dst
src and dst
[icmp]

Print each packet (minus its link level header) in ASCII

Log MAC addresses
Show only packets listed less than or equal than xxx Bytes
Show only packets listed greater than or equal than xxx Bytes
Dont print a timestamp on each dump line
Hostname or IP address (e.g. host gordon)
Network (e.g. net 192.168.5)
Port (e.g. port 21)
Portrange (e.g. portrange 1024-1032)
Source (e.g. src gordon)
Destination (e.g. dst port 21)
Source or Destination (e.g. src or dst port 80)
Source and Destination (e.g. src and dst port 443)
You can use e.g. the offset icmptype to filter different types of icmp-traffic:
icmp-echoreply, icmp-unreach, icmp-sourcequench, icmp-redirect, icmp-echo,
icmp-routeradvert, icmp-routersolicit, icmp-timxceed, icmp-paramprob, icmptstamp, icmp-tstampreply, icmp-ireq, icmp-ireqreply, icmp-maskreq, icmpmaskreply

Examples
To print all packets arriving at or departing from the host gordon

tcpdump host gordon

To print only ICMP-echo requests from the source-IP 192.168.1.10

tcpdump -i any -n icmp[icmptype]=icmp-echo and src 192.168.1.10

To print only ICMP-echo replies to the destination-IP 172.165.28.2
tcpdump -i any -n icmp[icmptype]=icmp-echoreply and dst 172.165.28.2
To print all ICMP packets those are not echo requests/replies (i.e., not ping packets)

tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'

To write all captured packets from host 192.168.73.4 arriving at or departing on eth7 to file dump in
pcap format

tcpdump -i eth7 -nvv -As0 host 192.168.73.4 -w /home/login/dump.pcap

To print only IKE-packets (IPSec) and NAT-T-packets (IPSec) arriving at or departing on eth0
(external interface)

tcpdump -vvni eth0 port 500 or port 4500