2

I need to capture traffic to https://gmail.com using tcpdump. I solved this by using tcpdump -n dst host <ipaddress of gmail> But is there any way I can directly specify gmail.com instead of the ipaddress so that it will capture the traffic to https://gmail.com.

5

Yes, you should definitely use

tcpdump -n dst host gmail.com

instead of

tcpdump -n dst host <ipaddress of gmail>

. This is because gmail.com has multiple IP addresses (I count 5 from my point of view: 4 v4 and 1 v6) and giving the name to the filter will automatically match all of them. Otherwise you have to specify a much longer filter that includes all of the addresses, such as this:

tcpdump -n host <ip1> or host <ip2> or host <ip3> [...]

Note: You have dst in your filter which will cause you to match only packets whose destination is gmail. That means you will capture only half the stream. Is that really what you want?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.