Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I need to do (via 'tcpdump' through Linux):

• ECommerce App Servers:,, - This is what I want to capture on (filtered on these exact IPs). Not an IP range (subnet) or an individual IP address, just several IP addresses/servers.

• There are other applications within this range, e.g. PayRoll App is on, and I don't want to see any of this traffic in my capture.

I have a tried:

tcpdump 0 "/tmp" "host or host or host" 100000

and also:

tcpdump 0 "/tmp" " or or" 100000

Both return syntax errors.

Any help is much appreciated.

share|improve this question
You could also try: tcpdump -D This will list all interfaces, if you aren't sure what interface to capture traffic on. Based on what you've tried, it seems that the 0 might be throwing it off. Also the "/tmp" and the "" when listing hosts. You shouldn't need "" to list hosts, but you do need to specify the interface prior to directories or options. – injector Nov 11 '14 at 15:27

the basic syntax in your case would be

tcpdump -i <interface to capture on> <filters>

The <filters> would expand to something like

'(host or host or host and (port 80 or port 443)'

if your eCommerce application would use ports 80 and 443 for communications. The single quotes are important, otherwise your shell might see the brackets () which are important for grouping parameters as special characters.

adding -v and -n parameters at the beginning (tcpdump -v -n -i ...)would add verbosity to the output and disable name resolution (speeds up output)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.