lldp - Link Layer Discovery Protocol (0x88CC).ipx - Internetwork Packet Exchange (0x8137).ipv6 - Internet Protocol Version 6 (0x86DD).ip - Internet Protocol version 4 (0x0800).arp - Address Resolution Protocol (0x0806).Mac protocols (instead of protocol names, protocol number can be used): Up to 16 comma separated entries used as a filter. vrrp - virtual router redundancy protocolįilter-mac-protocol ( protocol (max 16 items) Default: ).iso-tp4 - iso transport protocol class 4.igmp - internet group management protocol.icmpv6 - internet control message protocol v6.

icmp - internet control message protocol.idpr-cmtp - idpr control message transport.IP protocols (instead of protocol names, protocol number can be used) Up to 16 comma separated entries used as a filterįilter-ip-protocol ( protocol (max 16 items) Default: ) Up to 16 MAC addresses and MAC address masks used as a filterįilter-port ( port (max 16 items) Default: ) Name of the file where sniffed packets will be saved.įilter-ip-address ( ip/mask (max 16 items) Default: )įilter-mac-address ( mac/mask (max 16 items) Default: ) Packets that are processed with hardware offloading enabled bridge will also not be visible (unknown unicast, broadcast and some multicast traffic will be visible to sniffer tool).įile-limit ( integer 10.4294967295 Default: 1000KiB)įile size limit. Plain passwords on the command line are a security risk.Note: Unicast traffic between Wireless clients with client-to-client forwarding enabled will not be visible to sniffer tool. $ ssh 'echo | sudo -S tcpdump -U -s0 not port 22' -i eth0 -w - | sudo wireshark -k -i. You can check and find the proper one via $ ip link. It depends on its type and count off different interfaces.

And the network interface (eth0) in not necessarily eth0. Port is automatically chosen by protocol specification, so not necessarily required. Replace content in angle brackets to your needs. This enables root privileges for tcpdump on the host to be sniffed remotely. If you have no root access via ssh on your host being sniffed to, like on a raspberrypi, and for good reason you don't want to enable it or you simply can't do it, for whatever reason, there is a slightly different approach of (alternative to answer to that from we do here is to pipe the sudo password into the sudo command which executes its argument tcpdump.

Mikrotik wireshark capture