I'd like to filter ip messages which are constructed as follow (see picture below):

  1. GRE on top of IP
  2. GRE contains IP with UDP on port 1234 (in the picture below port 80).

How can I filter such messages?

enter image description here

PS operating system is windows based

1 Answer 1


I'm not sure by what you mean with "on top" of GRE so I'll include both.

  1. If you are trying to capture packets going to and from a GRE and you know the interface for the GRE tunnel you can do tcpdump -i GRE_INTERFACE host IP to show all traffic going to and from "IP", if you just want traffic going to it change host to dst. To get just UDP traffic on port 1234 tcpdump -i GRE_INTERFACE host IP and udp and port 1234

  2. If you are trying to capture GRE packets themselves you can do tcpdump -i any proto gre, if you have too much GRE traffic and want to see it by the specific tunnel do tcpdump -i any proto gre and host IP_OF_GRE_TUNNEL_REMOTE

I hope this helps

  • I've clarified my question by adding example packet capture Jul 28, 2021 at 12:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .