tcpdump -i any

To get the network packets from all network interfaces, run the following command,

get packets on localhost with port 8288

tcpdump -i lo0 port 8288

tcpdump -i eth0

get the network packets from a single interface

tcpdump -i eth0 -w wirte_file_name

write all the captured packets to a file, use the ‘-w’ option,

tcpdump -r packets_file

read an already created, old tcpdump file.

tcpdump net 192.168.1.0/24

get packets from a whole netwrok

tcpdump host 192.168.1.100

Get all the packets based on the IP address, whether source or destination or both

tcpdump ssh

check all the packets used based on the protocol

To get packets for a single port OR for a range of ports, use

$ tcpdump port 22
$ tcpdump portrange 22-8080

More..

To get packets based on source or destination of an IP address, use

$ tcpdump src 192.168.1.100
$ tcpdump dst 192.168.1.100
$ tcpdump src 192.168.1.100 && port 22 -w ssh_packets
$ tcpdump port 443 or 80 -w http_packets
$ tcpdump -i eth0 src port not 22