how to read pcap file, filter by ip address and port then write data to another file

pcap tcpdump

18,081

tcpdump takes a filter predicate, meaning it expects a logic expression with a boolean value once executed on a packet.

Here, it returns a syntax error because you're missing a logical and:

tcpdump -r tcpdumpep1.pcap -w output.txt host 184.107.41.72 and port 80

18,081

Author by

Updated on June 08, 2022

CyberNewbie almost 2 years
As part of a lab exercise that I am doing, I have been asked; using tcpdump read the packets from tcpdumpep1.pcap and filter packets from IP address 184.107.41.72 and port 80. Write these packets to a new file

I tried the following, but I'm getting a syntax error:
```
$ tcpdump -r tcpdumpep1.pcap -w output.txt host 184.107.41.72 port 80
reading from file tcpdumpep1.pcap, link-type EN10MB (Ethernet)
tcpdump: syntax error in filter expression: syntax error
```
CyberNewbie almost 6 years

tcpdump -r tcpdumpep1.pcap && host 184.107.41.72 and port 80 -w output.txt ??
pchaigno almost 6 years

No, just the command I provided, with the and should suffice.
CyberNewbie almost 6 years

Thank you, sir. So I wasn't a million miles off the correct answer. Thank you for your time.
pchaigno almost 6 years

Glad I could help! Do you want me to change anything to accept the answer?
CyberNewbie almost 6 years

No thats it all sorted. Thanks again.