Snort mailing list archives
Re: tcpdump filtered for multiple hosts
From: Harry Hoffman <hhoffman () ip-solutions net>
Date: Fri, 21 Oct 2005 22:43:06 -0400
It might be a little more clear to write it as such: tcpdump -i eth0 -s 0 host '( 10.10.10.1 and 10.10.10.2 )' -w dumpfile.dmp my $0.02, Harry Patrick Harper wrote:
Put an and between the host statements I believe tcpdump -I eth0 -s0 host 10.10.10.1 and host 10.10.10.2 -w dumpfile.dmp The -s0 will make it capture whatever the packet size stated in the header of the packet.
------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- tcpdump filtered for multiple hosts Court Graham (Oct 21)
- RE: tcpdump filtered for multiple hosts Patrick Harper (Oct 21)
- Re: tcpdump filtered for multiple hosts Harry Hoffman (Oct 21)
- <Possible follow-ups>
- Re: tcpdump filtered for multiple hosts Richard Bejtlich (Oct 22)
- RE: tcpdump filtered for multiple hosts Patrick Harper (Oct 21)