lunes, 15 de julio de 2024

uses cases of tcpdump

 filtering icmp traffic to/from specific host

$ sudo tcpdump -n icmp and host 10.16.100.5

also we can use the parameter -c[0-9] for only capture a defined number of packets

others parameters like port when we are setting tcp/udp are also useful

$ sudo tcpdump -i any -c5 -nn "port 80 and (src 192.168.10.125 or src 154.24.4.231)"

 other useful parameter is A, that one can show us the package content, it doesn't have any decrypt functionality