tcpdump filters for fast packet capture during investigations

3882 views

                  #!/usr/bin/env bash
tcpdump -i eth0 host 10.10.20.15 -w suspect-host.pcap
tcpdump -i eth0 port 443 and host api.example.com
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0'

Packet capture is most useful when it is scoped enough to answer a question quickly. I capture by host, port, subnet, or flag pattern rather than grabbing everything and hoping to sort it out later. Storage, privacy, and time all argue for precision.

Kai Nakamura

More from Kai Nakamura

tcpdump filters for fast packet capture during investigations

0 Comments

More from Kai Nakamura