Filter tcpdump by IP: Hosts, Direction, Subnets, and Ports

To filter packet captures using tcpdump, start by selecting the correct interface. On Linux, list available capture interfaces using tcpdump -D. Once you've identified the appropriate interface with -i, you can begin filtering the traffic. Use the host keyword to match either direction of traffic involving a specific IP address.

For example, sudo tcpdump -nn -i eth0 host 192.0.2.25 captures packets where 192.0.2.25 is either the source or destination. Replace the example address with the relevant one on your system. To filter traffic involving a subnet, use the net keyword with CIDR notation. For example, sudo tcpdump -nn -i eth0 net 192.0.2.0/24 captures packets whose source or destination belongs to the 192.0.2.0/24 network.

Remember that the direction qualifier (src or dst) can be added to narrow the filter to one side of the packet. To filter traffic based on port numbers, combine the host keyword with the tcp port number. For example, sudo tcpdump -nn -i eth0 host 192.0.2.25 and tcp port 443 captures TCP traffic involving the address 192.0.2.25 when either TCP port is 443.

When using multiple conditions, combine them using and and use parentheses to group conditions appropriately. For instance, sudo tcpdump -nn -i eth0 (host 192.0.2.25 or host 198.51.100.10) and tcp port 443 captures traffic between the specified hosts and port 443. To ensure the filter works as intended, check the assumptions behind it, such as the selected interface, direction of traffic, address and family, and any additional conditions. Permissions might also be required, so run tcpdump with elevated privileges using sudo.