topic packet display question in Network Security

packet display question

bmcelyea — Sun, 10 Mar 2019 10:15:54 GMT

I am having trouble passing arguments to tcpdump via the packet display command.

The tcpdump command I am trying to use is:

tcpdump -nvvX host 10.0.0.1

It seems I should use:

packet display GigabitEthernet0/0 expression -nvvX host 10.0.0.1

This doesnt work

This works:

packet display GigabitEthernet0/0 expression -nvvX

and this works:

packet display GigabitEthernet0/0 expression host 10.0.0.1

I cant get both working at the same time?

How do I pass two arguments throough the packet display command?

Re: packet display question

mhellman — Wed, 04 Oct 2006 17:24:22 GMT

I don't think that you're supposed to be able to provide ANY options to tcpdump like that. What you've found might be a bug. For example, I can bypass the normal file and size limitations for this command now by using a "...expression -wfoo.cap". Unfortunately, I can't provide a meaningful expression otherwise.

In any event, the -n option appears to be the default. The -v option is replaced with the keyword "verbose". I couldn't find a combination that allowed for -X and an actual expression.

I think you'll have to use packet capture.