tcpdump – Detailed Network Traffic Analysis & dump traffic on a network

Tcpdump prints out a description of the contents of packets on a network interface that match the boolean expression.the description is preceded by a time stamp, printed, by default, as hours, minutes, seconds, and fractions of a second

$ tcpdump -i <interface> -s 65535 -w <some-file>

OPTIONS

-i any : Listen on all interfaces just to see if you’re seeing any traffic.

-i eth0 : Listen on the eth0 interface.

-D : Show the list of available interfaces

-n : Don’t resolve hostnames.

-nn : Don’t resolve hostnames or port names.

-q : Be less verbose (more quiet) with your output.

-X : Show the packet’s contents in both hex and ASCII.

-XX : Same as -X, but also shows the ethernet header.

-v, -vv, -vvv : Increase the amount of packet information you get back.

-c : Only get x number of packets and then stop.

icmp : Only get ICMP packets.

-s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.

-S : Print absolute sequence numbers.

-e : Get the ethernet header as well.

-q : Show less protocol information.

-E : Decrypt IPSEC traffic by providing an encryption key.