My tcpdump Idiom

This is how I like to run tcpdump these days:
sudo tcpdump -U -s 0 -w - port 80 | tee DESCRIPTION-$(date +%s).pcap | tcpdump -lvvnr -

This dumps out a .pcap file I can open in Wireshark later, but also shows the tcpdump human-readable representation in real-time.

Leave a Reply

Your email address will not be published. Required fields are marked *