How to capture src and dst traffic (both directions) with tcpdump, with one command?

Question

I am using RedHat (6.5) bonding and my active interface is eth5.

Running the following command, I'm not able to see the traffic originated by my NIC IP address:

tcpdump -i eth5 src host actual_ip_address_of_external_client

I'm only able to see the source traffic too, via the command below (using wireshark):

tcpdump -i eth5 src host actual_ip_address_of_external_client -w /tmp/<outputfile>

What might be the problem?

Solution

To monitor traffic on both directions between host_a and host_b you can use:

# tcpdump -nli eth6 host host_a and host_b

Comments

[Bratchley]

Not 100% but I believe tcpdump supports the or operator

[Bratchley]

The question in this post includes an example of using the or operator.

[Selahattin]

thanks could you please me sample syntax regarding my situation ? or what else do you recommended instead of tcpdump command? please clarify

[Bratchley]

you should probably do something like tcpdump -i eth5 host <currentHost> or host <destinationHost> Just as an example: tcpdump -i eth5 host 192.168.122.23 or 192.168.122.25.

[Admin]

So are you saying that, without -w /tmp/<outputfile>, tcpdump doesn't print traffic from the actual_ip_address_of_external_client, but if you add -w /tmp/<outputfile> to the command, making no change to the filter or the -i argument, and then read the file in Wireshark, you do see traffic from that address?

[Selahattin]

@GuyHarris as you said I have facing same issue. Also I can see external IP address of host in wireshark as [source] from address. otherwise if an external host (say 118.168.141.172) made a connection, I would like to capture the traffic. OK?

[Selahattin]

thanks info I solved my issue e.g tcpdump -ni s0 vlan and host_a and host_b and tcp 80

[Velu]

sudo tcpdump -s 65535 -i eth0 host 10.78.5.118 and host 41.212.409.114 -w ssl.pcap