====== TCPDump ======


<code bash>
tcpdump -D

tcpdump -i <interface>

tcpdump -i <interface> [capture filter]
tcpdump -i <interface> port ## and udp

# -n: no conversion
tcpdump -i <interface> -n -w dump.pcap [cf]

tcpdump -i <interface> -n -w dump_%c.pcap -Z root -C 1000 [cf]
# rotate 10 log files
tcpdump -i <interface> -n -W 10 -w dump.pcap -Z root -C 1000 [cf]

</code>

  * for capture filters see [[soc:tools:wireshark]]