How to capture network traffic using Wireshark & TCPdump

How to capture network traffic using Wireshark & TCPdump

Using Wireshark (Grafical interface)

Install wireshark:
mahidul@mtr:~$ sudo apt-get install wireshark

Or, download it from official site https://www.archlinux.org

Error: Wireshark not listing interfaces on Ubuntu 12.04 precise pangolin
Solution:
mahidul@mtr:~$ sudo dpkg-reconfigure wireshark-common
mahidul@mtr:~$ sudo usermod -a -G wireshark $USER
mahidul@mtr:~$ sudo reboot

Reference:
http://it-connects.co/wireshark-not-listing-interfaces-on-ubuntu-12-04-precise-pangolin/


Using TCPdump (Command Line Interface)
Install tcpdump in redhat.
[root@mahidul ~]# yum install tcpdump

Install tcpdump in ubuntu.
mahidul@mtr:~$ apt-get install tcpdump

Check if tcpdump installed properly.
[root@mahidul ~]# rpm -qa | grep tcpdump

1. Capture Packets from Specific Interface
[root@mahidul ~]# tcpdump -i eth0

2. Capture Only N Number of Packets
[root@mahidul ~]# tcpdump -c 5 -i eth0

3. Display Available Interfaces
[root@mahidul ~]# tcpdump -D

4. Display Available Interfaces
[root@mahidul ~]# tcpdump -D

5. Display Captured Packets in HEX and ASCII
[root@mahidul ~]# tcpdump -XX -i eth0

6. Capture and Save Packets in a File
[root@mahidul ~]# tcpdump -w 0001.pcap -i eth0

7. Read Captured Packets File
[root@mahidul ~]# tcpdump -r 0001.pcap

8. Capture IP address Packets
[root@mahidul ~]# tcpdump -n -i eth0

9. Capture only TCP Packets.
[root@mahidul ~]# tcpdump -i eth0 tcp

10. Capture Packet from Specific Port
[root@mahidul ~]# tcpdump -i eth0 port 22

11. Capture Packets from source IP
[root@mahidul ~]# tcpdump -i eth0 src 192.168.0.2

12. Capture Packets from destination IP
[root@mahidul ~]# tcpdump -i eth0 dst 50.116.66.139
 

Reference:
http://www.tecmint.com/12-tcpdump-commands-a-network-sniffer-tool/

Read More