Monitoring multiple ports in tcpdump

networking tcpdump
mawia picture mawia · Feb 2, 2010 · Viewed 100.6k times · Source

I am trying to find a way to read multiple ports using tcpdump. Suppose I have two ports, p1 and p2, and I want to read the traffic moving through both ports simultaneously. Is there any way to do it using tcpdump or will I have to use some other tool?

Basically I am running a proxy server which is running on some port. I want to read the traffic moving through this port as well traffic moving through port 80(HTTP).

Answer

caf picture caf · Feb 3, 2010 
tcpdump port 80 or port 3128

or, alternatively,

tcpdump port '(80 or 443)'

Related questions

How can I use TCPDump on Unix to view messages sent to a specific multicast address?

I'm trying to view traffic transmitted to a specific multicast address on a network in order to analyze a protocol we're using. I don't have Wireshark available on the setup (unfortunately). TCPDump is available though. So, can anyone show me …

Read More
Saving the displayed/filtered packets in wireshark

I applied a filter in wireshark to display only the incoming packets to my PC. When I save the filtered/displayed packets to a .csv file, I actually saves all the packets (un-filtered). How can I save only the displayed/…

Read More
Capture only ssl handshake with tcpdump

I have a server to which many clients connect using SSL. Recently I'm observing SSL handshake errors in the server logs (ex SSL MAC error). The error itself is not important, but I want to see why some clients are …

Read More