Capture
_$: tcpdump -i eth0 src 192.168.1.10 # Traffic from 192.168.1.10
_$: tcpdump -i eth0 dst 192.168.1.10 # Traffic to 192.168.1.10
_$: tcpdump -i eth0 host 192.168.1.10 # Traffic from/to 192.168.1.10
_$: tcpdump -i eth0 port 53 # Traffic in the port 53
_$: tcpdump -i eth0 udp and src port 53 # UDP traffic UDP in the port 53 (DNS queries)
_$: tcpdump -i eth0 icmp # ICMP traffic
Write to a file
_$: tcpdump [...] -w /tmp/file.pcap # No olvidar los filtros de captura
Read from a file
_$: tcpdump -nr /tmp/file.pcap