Packet Capture, part 2 - Page 7

In this segment from the O'Reilly book, Network Troubleshooting Tools, you will learn all abut how to use the tcpdump in relation to packet capturing.

 By O'Reilly Press
Page 7 of 10   |  Back to Page 1
Print Article Filtering

To effectively use tcpdump, it is necessary to master the use of filters. Filters permit you to specify what traffic you want to capture, allowing you to focus on just what is of interest. This can be absolutely essential if you need to extract a small amount of traffic from a massive trace file. Moreover, tools like ethereal use the tcpdump filter syntax for capturing traffic, so you'll want to learn the syntax if you plan to use these tools.

If you are absolutely certain that you are not interested in some kinds of traffic, you can exclude traffic as you capture. If you are unclear of what traffic you want, you can collect the raw data to a file and apply the filters as you read back the file. In practice, you will often alternate between these two approaches.

Filters at their simplest are keywords added to the end of the command line. However, extremely complex commands can be constructed using logical and relational operators. In the latter case, it is usually better to save the filter to a file and use the -F option. For example, if testfilter is a text file containing the filter host, then typing tcpdump -Ftestfilter is equivalent to typing the command tcpdump host Generally, you will want to use this feature with complex filters only. However, you can't combine filters on the command line with a filters file in the same command. Address filtering.

It should come as no surprise that filters can select traffic based on addresses. For example, consider the command:

bsd1# tcpdump host

This command captures all traffic to and from the host with the IP address The host may be specified by IP number or name. Since an IP address has been specified, you might incorrectly guess that the captured traffic will be limited to IP traffic. In fact, other traffic, such as ARP traffic, will also be collected by this filter. Restricting capture to a particular protocol requires a more complex filter. Nonintuitive behavior like this necessitates a thorough testing of all filters.

Addresses can be specified and restricted in several ways. Here is an example that uses the Ethernet address of a computer to select traffic:

bsd1# tcpdump ether host 0:10:5a:e3:37:c

Capture can be further restricted to traffic flows for a single direction, either to a host or from a host, using src to specify the source of the traffic or dst to specify the destination. The next example shows a filter that collects traffic sent to the host at but not from it:

bsd1# tcpdump dst 

Note that the keyword host was omitted in this example. Such omissions are OK in several instances, but it is always safer to include these keywords.

Multicast or broadcast traffic can be selected by using the keyword multicast or broadcast, respectively. Since multicast and broadcast traffic are specified differently at the link level and the network level, there are two forms for each of these filters. The filter ether multicast captures traffic with an Ethernet multicast address, while ip multicast captures traffic with an IP multicast address. Similar qualifiers are used with broadcast traffic. Be aware that multicast filters may capture broadcast traffic. As always, test your filters.

Traffic capture can be restricted to networks as well as hosts. For example, the following command restricts capture to packets coming from or going to the network:

bsd1# tcpdump net 205.153.60

The following command does the same thing:

bsd1# tcpdump net mask

Although you might guess otherwise, the following command does not work properly due to the final .0:

bsd1# tcpdump net

Be sure to test your filters!

This article was originally published on Nov 13, 2001
Get the Latest Scoop with Networking Update Newsletter