Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

CentOS 5.x

Hello All,

I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow that? The other IPs receive a lot of traffic so I'd prefer to not capture data pertaining to them and have to filter them out later... .


share|improve this question
up vote 4 down vote accepted

Try this:

tcpdump -i any dst host your.ip.add.ress and port https

use http instead of https if you want to capture port 80 instead of 443 - or just use the numbers directly if you like. (The http/https names are mapped to the port numbers via lookup in /etc/services)

share|improve this answer
+1 for correcting my mistake. – wolfgangsz Aug 17 '10 at 19:30
Brilliant. Worked perfectly. Thanks! – Mike B Aug 24 '10 at 21:13

Try this:

tcpdump -i any dst host your.ip.add.ress and port 80
share|improve this answer
wrong port for https – pjz Aug 17 '10 at 17:55
tcpdump -n -i <INTERFACE> host <IP>

That should do it. -n will not resolve names.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.