3.4. Tcpdump-x

Tcpdump-x is a wrapper around tcpdump. It has the advantage over the normal tcpdump command that the parameters are in a friendlier format and that it can capture on multiple interfaces at the same time.

It knows the following parameters:

In the following example, the first command will capture all packets on the lan0_0 and wan0_0 interfaces between host 10.0.1.1 and host 192.168.1.1. The second command captures all packets on the lan0_0 and wan0_0 interfaces for 30 seconds, maximum file size is 10 Mb and the maximum number of files is 12. The third command shows all running tcpdump-x captures. The fourth command terminates the first command and the fifth command shows all the tcpdump captures.

Figure 3.22. Examples for using tcpdump-x

SH # tcpdump-x interfaces lan0_0,wan0_0 capture-name test1 snaplength 1600 custom 'host 10 \
    .0.1.1 and host 192.168.1.1' continuous
SH # tcpdump-x interfaces lan0_0,wan0_0 capture-name test2 snaplength 1600 rotate-count 12 \
     duration 30 file-size 10
SH # show tcpdump-x
Name: test1
Start Time: 21:41:14
SH # tcpdump-x capture-name test1 stop
SH # show files tcpdump
SH_lan0_0_test1.cap0
SH_wan0_0_test1.cap0
SH_lan0_0_test2.cap0
SH_wan0_0_test2.cap0

Note that order of the options can be specific, so always use the ? to see which options are available!