TCPDump Command for Troubleshooting
Primary TCPDump Command
# tcpdump -nni <interface>:nnnp -s 0 -w <filename>
Command Breakdown:
-n: Disables name resolution (IP addresses are not translated to hostnames).
-n: Disables port translation (ports are shown as numbers).
-i <interface>: Specifies the interface to capture traffic on (e.g., VLAN, Route Domain).
:nnn: Noise amplitude for filtering (optional).
-p: Peer flow, copies matching peer flows.
-s 0: Snap length (0 = capture the full packet).
-w <filename>: Writes the output to a file in binary format (e.g., <filename>.cap).
Using TCPDump with Specific Examples
1. Selecting an Interface or VLAN
To capture traffic on a specific interface or VLAN:
Specific interface:
tcpdump -i 2.1
VLAN named internal:
tcpdump -i internal
Management interface:
tcpdump -i eth0
All interfaces:
tcpdump -i 0.0
2. Disabling Name Resolution
To speed up and simplify output by disabling DNS lookups:
tcpdump -n
Example:
tcpdump -ni internal
3. Saving TCPDump Output
Binary File Output
To save TCPDump data in binary format (compatible with Wireshark and other tools):
tcpdump -w output.cap
Text File Output
To save the TCPDump data as readable plain text:
tcpdump > output.txt
TCPDump Options and Descriptions
Option
Description
-i <interface>
Captures traffic on the specified interface.
-n
Disables name resolution (faster output).
-s 0
Captures the full packet (default).
-w <filename>
Writes output to a binary file (e.g., Wireshark-readable).
-nn
Disables both address and port resolution.
:nnn
Filters by noise amplitude.
-p
Captures peer flows (optional: :nnnp or :p).
> <filename>
Writes output to a plain text file.
Example Commands
Capture traffic on the VLAN "internal" without name resolution:
tcpdump -ni internal
Save captured traffic on all interfaces to a binary file:
tcpdump -i 0.0 -w traffic.cap
Capture traffic on management interface (eth0) with full packets:
tcpdump -ni eth0 -s 0
Capture and save traffic on a VLAN to a text file:
tcpdump -i internal > output.txt
Let me know if you need further assistance or additional examples!