tcpdump

tcpdump -ni 0.0 src xx.xx.xx.xx and port xx

 

replace the x with ip address and port

 

eg: tcpdump -ni 0.0 src 10.1.1.4 and port 80

 

Hi,

Nice article by F5 on TCPDUMP with all needed command:

https://support.f5.com/csp/article/K411

Additional point keep in mind that if you want to capture traffic on all interface you have to set

tcpdump -ni 0.0

however you will not capture traffic that pass trough mangement interface with this command.

If you want to capture traffic that pass trough mgmt interface you have to specify mgmt interface like that:

tcpdump -ni eth0

If you want to capture dest port 80 use this command for example:

tcpdump -nni 0.0 src host 172.16.101.20 and dst port 80

For info:

-nn disable both name and service port resolution while performing a capture.

-i allow to select interface

Regards