Personal tools
You are here: Home → Tools → Wireshark (formally Ethereal) → Tcpdump Filters

Tcpdump Filters

Examples of capture filters in tcpdump syntax

Tcpdump filters

  • host 10.0.20.20
  • host 10.0.20.20 and tcp
  • host 10.0.20.20 and tcp and port 80
  • host 10.0.10.10 and net 192.168.0.0/16
     Capture communications between the 10.0.10.10 and the Class B sized 192.168.0.0/16 network
  • tcp[2] & 0x02 != 0
    TCP datagrams with SYN flag set

Equivalent filters in ethereal display filter syntax

  • ip.addr == 10.0.20.20
  • ip.addr == 10.0.20.20 and tcp
  • ip.addr == 10.0.20.20 and tcp.port == 22
  • tcp.flags.syn == 1
    Show the beginning of attempted tcp connections
Document Actions
Helpful Tools