> For the complete documentation index, see [llms.txt](https://securityshark.gitbook.io/oscp-prep/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://securityshark.gitbook.io/oscp-prep/tools-and-techniques/sniffing/tcpdump.md). # tcpdump tcpdump --help tcpdump -i eth0 -v this will capture everything on the interface along with verbosity and will not output in any file hence :- capture everything on basis of filter tcpdump -i eth0 -v host <$ip> ^ to find ip in source/desti\ tcpdump -i eth0 -v host abcd.com tcpdump -i eth0 -v src <$ip> and dst <$ip> ^ source ip ^&& in wireshark ^ dst ip tcpdump -i eth0 -v net 192.168.0.0/24 ^to scan for the range tcpdump -i eth0 -v tcp and net 192.168.0.0/24 to capture only tcp data tcpdump -i eth0 -v port 80 ^ to capture traffic specifc to port tcpdump -i eth0 -v src port 80 and dst <$ip> saving output in pcap file tcpdump -i eth0 -v port 80 -w /root/Desktop/traffic.pcap -n dont resolve for dns -nn dont resolve for dns and protocol -i any all interfaces -c 30 restrict the count of packets