Introduction to Ethereal (v.0.9.9), The Open Source Network-Protocol Analyzer

19
Ethereal
...Getting started: tcpdump capture filters...
More tcpdump examples:
• Capture all telnet traffic not from ip address 10.0.0.5:
$ tcpdump tcp port 23 and \
not host 10.0.0.5
•Capture onlySMBs:
$ tcpdump tcp[24:4] = 0xff534d42
•From the tcpdump manpage:
To print the start and end packets (the SYN and FIN
packets) of each TCP conversation that involves a non-
local host:
$ tcpdump 'tcp[13] & 3 != 0 and \
not src and dst net localnet'