how to capture package at a specific port on any interface using tshark

packet-capture tshark
zhaojing picture zhaojing · Apr 28, 2012 · Viewed 20.2k times · Source

I want to capture the package on a specific port on any interface of my machine.

I know how to capture the package on a specific port with a specific interface. And the command is

tshark -f "udp port 162" -i bond0

And if no interface is specified, TShark searches the list of interfaces, choosing the first non-loopback interface if there are any non-loopback interfaces.

But I want to capture the package on all the interface of my machine. Could anyone help me on this?

Thanks a lot!

Answer

dc5553 picture dc5553 · Apr 28, 2012 
tshark -f "udp port 162" -i any

works for me here on Linux(CentOS).

Related questions

How do I use tshark to print request-response pairs from a pcap file?

Given a pcap file, I'm able to extract a lot of information from the reconstructed HTTP request and responses using the neat filters provided by Wireshark. I've also been able to split the pcap file into each TCP stream. Trouble …

Read More
Wireshark localhost traffic capture

I wrote a simple server app in C which runs on localhost. How to capture localhost traffic using Wireshark?

Read More
How can I capture packets in Android?

I would like to capture TCP packets as well as protocol data such as HTTP and HTTPS in Android, similar to Wireshark in Windows. How can I do this in Android?

Read More