I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially blacklisted IPs.

I have read about tcpdump -F in the man page that explains that I can load tcpdump configuration from a file, however, I cannot seem to find much in the way of documentation of how to structure this file or how to load large numbers of IPs into the filtering as I constantly get syntax errors.

How would I easily implement IP address lists with tcpdump?

  • 1
    The -F file should contain a filter in the syntax of libpcap: man 7 pcap-filter – user41515 Jun 21 '13 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.