I have a Adapter installed and working on RHEL server which faces disconnection when a particular signal message is sent from the Source to which this adapter is connected.

In order to capture the raw packets from the Source IP address I am using the tcpdump utility. However, the problem with using tcpdump is that it continuously captures all the packets from the source including the traffic in which I am not interested.

This leads to huge disk space utilization because there is a huge incoming of data from the source IP address on this particular port which is used for communication between my adapter and the source server.

Is there a way or default Linux utility which can be used to capture only those packets which have a specific string eg. eventLossOccurred so that at the end, I just have those packets captured which contains those messages?

I have searched the various options for tcpdump however, I didn't find a way to get the desired results using this utility.

1 Answer 1


You can use 'tshark' (part of wireshark) and use display filter "contains/matches" to look for a string. Assuming it's a tcp packet, your filter could be something like this

tshark -Y 'tcp contains "eventLossOccurred"'

using 'matches', you could specify perl regular expressions

NOTE: This will only display the packet details, you cannot use this to capture full packet dump in PCAP format. Modify tshark options to display required details


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .