Network Monitoring on Support Tools

How to Use tcpdump to Capture Incoming Traffic

Fri, 13 Oct 2023 11:30:00 -0500

How to Use tcpdump to Capture Incoming Traffic

If you need to capture incoming network traffic using tcpdump, the most reliable option is to use the -Q option as follows:

bash
tcpdump -Qin other filter logic

The -Q option may not be supported on all platforms, and an alternative is to use equivalent logic in BPF (Berkeley Packet Filter) syntax in the form of the inbound predicate:

How to Filter MAC Addresses Using tcpdump

Fri, 13 Oct 2023 10:45:00 -0500

How to Filter MAC Addresses Using `tcpdump`

Suppose you’re using tcpdump for network monitoring and must filter traffic based on MAC addresses. In that case, you can utilize the “ether” qualifier to specify Ethernet addresses in the standard colon-separated format. Here’s how you can do it:

To capture any broadcast traffic, use the following command:

bash
tcpdump ether dst ff:ff:ff:ff:ff:ff

This command will capture all packets sent to the broadcast MAC address.