抓埠8080的包
tcpdump tcp port 8080 -n
tcpdump tcp port 8080 -w /tmp/xxxx.cap

抓119.29.121.116的80埠的包
tcpdump tcp port 8080 and host 10.104.102.228 -n
tcpdump tcp port 8080 and host 10.104.102.228 -w /tmp/xxxx.cap
-----------------------------------------

tcpdump 的抓包儲存到檔案的命令引數是-w xxx.cap

抓eth0的包

tcpdump -i eth0 -w /tmp/xxx.cap

抓埠8080的包

tcpdump tcp port 8080 -w /tmp/xxxx.cap

抓 119.29.121.116的包

tcpdump -i eth0 host 119.29.121.116 -w /tmp/xxx.cap

抓119.29.121.116的80埠的包

tcpdump -i eth0 host 119.29.121.116 and port 80 -w /tmp/xxx.cap

抓119.29.121.116的icmp的包

tcpdump -i eth0 host 119.29.121.116 and icmp -w /tmp/xxx.cap

抓119.29.121.116的80埠和110和25以外的其他埠的包

tcpdump -i eth0 host 119.29.121.116 and ! port 80 and ! port 25 and ! port 110 -w /tmp/xxx.cap

抓vlan 1的包

tcpdump -i eth0 port 80 and vlan 1 -w /tmp/xxx.cap

抓pppoe的密碼

tcpdump -i eth0 pppoes -w /tmp/xxx.cap

以100m大小分割儲存檔案， 超過100m另開一個檔案 -C 100m

抓10000個包後退出 -c 10000

後臺抓包， 控制檯退出也不會影響：

nohup tcpdump -i eth0 port 110 -w /tmp/xxx.cap &

抓下來的檔案可以直接用ethereal 或者wireshark開啟。