Once the dump is finished, ship the dump over to my desktop and analyze the full contents with Wireshark. The protocol dissectors, along with the ability to follow TCP streams, make life SO much easier.
If I already know exactly what I'm going to look for I'll add the "and [tcp|udp] and port $port" bit at the end. Gives a nice kickstart to any traffic analysis.
Comments
The one stanza I use most often:
# tcpdump -n -i $iface -s 0 -w /path/to/dump.pcap -c 25000 host a.b.c.d/mask
Once the dump is finished, ship the dump over to my desktop and analyze the full contents with Wireshark. The protocol dissectors, along with the ability to follow TCP streams, make life SO much easier.
If I already know exactly what I'm going to look for I'll add the "and [tcp|udp] and port $port" bit at the end. Gives a nice kickstart to any traffic analysis.