tcpdump not capturing http or tcp/ssl traffic

Question

I have been trying to learn tcpdump and I am using this command to attempt to monitor my network:

sudo tcpdump -I -i en1

But this gives me a bunch of stuff I don't want, so I used this version to filter the packets:

sudo tcpdump -I -i en1 port 80 or 443

And it gives me nothing. I know you can't use your WiFi when using monitor mode, but I still can, so I think thats a sign something is wrong. I tried it with en0, but it couldn't go into monitor mode.

What am I doing wrong?

I am using a MacBook Pro with OS X 10.9.3, and I would like to be able to do this with tcpdump, or any other utility that's built into OS X.

Answer 1

Sometimes the traffic is buffered or delayed by DNS server responses. To avoid it, add -l and -n parameters.

-l Make stdout line buffered. Useful if you want to see the data while capturing it.

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

Then you can use syntax like:

sudo tcpdump -i en1 -nl port http or port https

For more complex queries, make sure you use brackets to group the expressions.