I need to capture traffic to https://gmail.com using tcpdump. I solved this by using
tcpdump -n dst host <ipaddress of gmail> But is there any way I can directly specify gmail.com instead of the ipaddress so that it will capture the traffic to https://gmail.com.
Yes, you should definitely use
tcpdump -n dst host gmail.com
tcpdump -n dst host <ipaddress of gmail>
. This is because
gmail.com has multiple IP addresses (I count 5 from my point of view: 4 v4 and 1 v6) and giving the name to the filter will automatically match all of them. Otherwise you have to specify a much longer filter that includes all of the addresses, such as this:
tcpdump -n host <ip1> or host <ip2> or host <ip3> [...]
Note: You have
dst in your filter which will cause you to match only packets whose destination is gmail. That means you will capture only half the stream. Is that really what you want?