how to capture only http with tcpdump with linux

user2302639 picture user2302639 · Aug 18, 2016 · Viewed 25.4k times · Source

First I capture all data with : tcpdump -i any -s 0 -w /tmp/http.cap

no I want capture 'only http'

I tried to add : and port http

But it is incorrect.

thanks

Answer

Dmitry picture Dmitry · Aug 18, 2016

Check this:

tcpdump -i any -s 0 'tcp port http' -w /tmp/http.cap