A good tutorial but there some missing options or remarks that are very handy like:
- -A is equivalent to -X displaying the payload of the packet in ASCII format. If you want to do some scripting based on a payload, that's very handy for matching specific pattern (don't forget offset notation '[a:b]' is limited to 4 bytes block in the bpf filter)
- -tttt if you want to print the complete time-stamp per packet
- When capturing on a long period of time, the -G or -C helps to rotate capture files while capturing. tcpdump -i en1 -s 0 -G 60 -w tst%y%m%d%H%M%S.cap (if you want to rotate the file every 60 secs) or -C to do the rotation based of the size of the capture file.
- There are many tcpdump forks (OpenBSD tcpdump is slightly different than the tcpdump on Debian)
The power of a ring buffered capture should not be underestimated. Having an intermittent problem that you can't seem to catch while it's happening? Just let the capture run saving the last 2hrs of traffic. When the problem happens, pull the capture files.
Personally I prefer dumpcap and wireshark for this, but it's similar.
- -A is equivalent to -X displaying the payload of the packet in ASCII format. If you want to do some scripting based on a payload, that's very handy for matching specific pattern (don't forget offset notation '[a:b]' is limited to 4 bytes block in the bpf filter)
- -tttt if you want to print the complete time-stamp per packet
- Don't forget that TCP offloading might have an impact when doing packet capture (and analysis) http://sandilands.info/sgordon/segmentation-offloading-with-...
- When capturing on a long period of time, the -G or -C helps to rotate capture files while capturing. tcpdump -i en1 -s 0 -G 60 -w tst%y%m%d%H%M%S.cap (if you want to rotate the file every 60 secs) or -C to do the rotation based of the size of the capture file.
- There are many tcpdump forks (OpenBSD tcpdump is slightly different than the tcpdump on Debian)