0

I have to capture all the UDP packets sent from host A to any UDP port of host B. The following, if run on host B, doesn't work.

$ sudo tcpdump -i eth0 -SX udp src <hostA>
tcpdump: 'udp' modifier applied to host

What is the correct command line to achieve the same?

3

I would use

sudo tcpdump -i eth0 -s 0  -w tcpdump.pcap host hostA and udp

to up the length to "a lot", write the data to a file and use host rather than src to capture the data in both directions. Essentially you are missing the word and between src and udp.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.