2

CentOS 5.x

I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow that? The other IPs receive a lot of traffic so I'd prefer to not capture data pertaining to them and have to filter them out later... .

6

Try this:

tcpdump -i any dst host your.ip.add.ress and port https

use http instead of https if you want to capture port 80 instead of 443 - or just use the numbers directly if you like. (The http/https names are mapped to the port numbers via lookup in /etc/services)

  • +1 for correcting my mistake. – wolfgangsz Aug 17 '10 at 19:30
2

Try this:

tcpdump -i any dst host your.ip.add.ress and port 80
  • wrong port for https – pjz Aug 17 '10 at 17:55
1
tcpdump -n -i <INTERFACE> host <IP>

That should do it. -n will not resolve names.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.