Tcpdump-x is a wrapper around tcpdump. It has the advantage over the normal tcpdump command that the parameters are in a friendlier format and that it can capture on multiple interfaces at the same time.
It knows the following parameters:
all-interfaces: Capture on all interfaces
interfaces <interface list> Capture on the specified interfaces, comma separated.
capture-name <identifier>: Use the specified identifier to identify the files stored when the capture is finished.
snaplength <length>: Capture the first length bytes per frame. Use 1600 for a full packet.
custom <pcap filter>: Use this pcap filter to limit the packets captured. It is fed to tcpdump so all the primitives available to tcpdump are possible here.
continuous: Do not automatically terminate the capture after a certain time period
duration <number of seconds>: Run the capture for number of seconds seconds.
file-size <size>: Rotate the capture file when its size is size megabytes.
rotate-count <number>: Store at maximum number capture files per interface.
stop <capture-name>: Stop the capture specified by the previous capture-name.
In the following example, the first command will capture all packets on the lan0_0 and wan0_0 interfaces between host 10.0.1.1 and host 192.168.1.1. The second command captures all packets on the lan0_0 and wan0_0 interfaces for 30 seconds, maximum file size is 10 Mb and the maximum number of files is 12. The third command shows all running tcpdump-x captures. The fourth command terminates the first command and the fifth command shows all the tcpdump captures.
Figure 3.22. Examples for using tcpdump-x
SH # tcpdump-x interfaces lan0_0,wan0_0 capture-name test1 snaplength 1600 custom 'host 10 \ .0.1.1 and host 192.168.1.1' continuous SH # tcpdump-x interfaces lan0_0,wan0_0 capture-name test2 snaplength 1600 rotate-count 12 \ duration 30 file-size 10 SH # show tcpdump-x Name: test1 Start Time: 21:41:14 SH # tcpdump-x capture-name test1 stop SH # show files tcpdump SH_lan0_0_test1.cap0 SH_wan0_0_test1.cap0 SH_lan0_0_test2.cap0 SH_wan0_0_test2.cap0
Note that order of the options can be specific, so always use the ? to see which options are available!