tcpdump syntax for only capturing traffic coming to a specific virtual interface / local IP

Question

CentOS 5.x

Hello All,

I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow that? The other IPs receive a lot of traffic so I'd prefer to not capture data pertaining to them and have to filter them out later... .

-M

Answer 1

Try this:

tcpdump -i any dst host your.ip.add.ress and port https

use http instead of https if you want to capture port 80 instead of 443 - or just use the numbers directly if you like. (The http/https names are mapped to the port numbers via lookup in /etc/services)

Answer 2

Try this:

tcpdump -i any dst host your.ip.add.ress and port 80

Answer 3

tcpdump -n -i <INTERFACE> host <IP>

That should do it. -n will not resolve names.