Technical data

tcpdump
tcpdump
Provides dump analysis and packet capturing.
Format
tcpdump ["-B" |d|e|f|l|m|n|"-N" | "-O" |q|s|"-S" | t | v | x | "-X"]
[-b buffers]
[-c count]
[-F file]
[-r file]
[-s snaplen]
[-w file] expression
Description
The tcpdump utility displays the headers and contents of packets on the network
that match a boolean expression (filter). If no filter is supplied all packets
processed by tcpdump will be displayed. The the packets that are processed can
also be written to a binary file for later examination and filtering.
Parameters
expression
A boolean expression that provides a filter to select the packets to dump. If you
do not specify the expression, all packets on the network are dumped. Otherwise,
only packets that match the expression are dumped.
For information about specifying expressions, refer to Section 1.2.5.2.
Options
-b
Specifies the number of buffers used to communicate with the TCP/IP kernel.
The default is 400 on Alpha systems and 50 on VAX systems.
"-B"
Displays buffer diagnostics showing when dropped packets occur. Use quotation
marks to preserve the case of uppercase options.
-c
Exits after receiving count packets.
-d
Dumps the compiled packet-matching code to standard output and stops.
-e
Displays the link-level header on each dump line.
-f
Displays foreign internet addresses numerically rather than symbolically.
"-F" file
Uses file as input for the filter expression. Any additional expressions on the
command line are ignored. Use quotation marks to preserve the case of uppercase
options.
A–42 Troubleshooting Utilities Reference