I've tried it for a while now, referring to resources on the net and man tcpdump
. I just can't get it to work. I've tried sudo tcpdump -i any -A "dst port 62655 and src port 62665"
, then I tried sudo tcpdump -i any -A "(dst port 62655 and src port 62665)"
. I also tried sudo tcpdump -i any -A \(dst port 62655 and src port 62665\)
. I'm going nuts, what am I missing?? According to man tcpdump
it's okay to use either and
or &&
EDIT:
What do I mean by "it doesn't work"? If I only use sudo tcpdump -i any -A "dst port 62655"
I can see the traffic from the server to the client. If I try to combine it in order to try to catch the incoming traffic as well (as described above) I see nothing (not even the outgoing traffic anymore - which worked before!).
By using "and", you're requiring each packet to meet both conditions. Your edit makes it sound like one condition is for incoming and one condition is for outgoing, so use "or" instead of "and".
As an aside, especially for common ports where there's likely more traffic, it's often useful to specify "host X.X.X.X" to filter for packets where the source or destination is the specified IP address.