How to capture src and dst traffic (both directions) with tcpdump, with one command?

Question

I am using RedHat (6.5) bonding and my active interface is eth5.

Running the following command, I'm not able to see the traffic originated by my NIC IP address:

tcpdump -i eth5 src host actual_ip_address_of_external_client

I'm only able to see the source traffic too, via the command below (using wireshark):

tcpdump -i eth5 src host actual_ip_address_of_external_client -w /tmp/<outputfile>

What might be the problem?

thanks could you please me sample syntax regarding my situation ? or what else do you recommended instead of tcpdump command? please clarify — Selahattin, Commented Mar 31, 2015 at 19:24
you should probably do something like tcpdump -i eth5 host <currentHost> or host <destinationHost> Just as an example: tcpdump -i eth5 host 192.168.122.23 or 192.168.122.25. — Bratchley, Commented Mar 31, 2015 at 19:35
So are you saying that, without -w /tmp/<outputfile>, tcpdump doesn't print traffic from the actual_ip_address_of_external_client, but if you add -w /tmp/<outputfile> to the command, making no change to the filter or the -i argument, and then read the file in Wireshark, you do see traffic from that address? — user44841, Commented Apr 1, 2015 at 2:47
@GuyHarris as you said I have facing same issue. Also I can see external IP address of host in wireshark as [source] from address. otherwise if an external host (say 118.168.141.172) made a connection, I would like to capture the traffic. OK? — Selahattin, Commented Apr 1, 2015 at 5:52

petry · Accepted Answer · 2015-03-31 20:44:51Z

11

To monitor traffic on both directions between host_a and host_b you can use:

# tcpdump -nli eth6 host host_a and host_b

answered Mar 31, 2015 at 20:44

petry

9981 gold badge8 silver badges14 bronze badges

thanks info I solved my issue e.g tcpdump -ni s0 vlan and host_a and host_b and tcp 80
– Selahattin
Commented Apr 4, 2015 at 12:32
sudo tcpdump -s 65535 -i eth0 host 10.78.5.118 and host 41.212.409.114 -w ssl.pcap
– Velu
Commented Apr 5, 2020 at 16:09

Add a comment |

1 Answer 1