I am using RedHat (6.5) bonding and my active interface is eth5.

Running the following command, I'm not able to see the traffic originated by my NIC IP address:

tcpdump -i eth5 src host actual_ip_address_of_external_client

I'm only able to see the source traffic too, via the command below (using wireshark):

tcpdump -i eth5 src host actual_ip_address_of_external_client -w /tmp/<outputfile>

What might be the problem?

  • Not 100% but I believe tcpdump supports the or operator – Bratchley Mar 31 '15 at 19:04
  • The question in this post includes an example of using the or operator. – Bratchley Mar 31 '15 at 19:04
  • thanks could you please me sample syntax regarding my situation ? or what else do you recommended instead of tcpdump command? please clarify – Selahattin Mar 31 '15 at 19:24
  • you should probably do something like tcpdump -i eth5 host <currentHost> or host <destinationHost> Just as an example: tcpdump -i eth5 host or – Bratchley Mar 31 '15 at 19:35
  • So are you saying that, without -w /tmp/<outputfile>, tcpdump doesn't print traffic from the actual_ip_address_of_external_client, but if you add -w /tmp/<outputfile> to the command, making no change to the filter or the -i argument, and then read the file in Wireshark, you do see traffic from that address? – user44841 Apr 1 '15 at 2:47

To monitor traffic on both directions between host_a and host_b you can use:

# tcpdump -nli eth6 host host_a and host_b
| improve this answer | |
  • thanks info I solved my issue e.g tcpdump -ni s0 vlan and host_a and host_b and tcp 80 – Selahattin Apr 4 '15 at 12:32
  • sudo tcpdump -s 65535 -i eth0 host and host 41.212.409.114 -w ssl.pcap – Velu Apr 5 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.