LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-28-2019, 10:47 AM   #1
mackowiakp
Member
 
Registered: Jun 2014
Location: Poland/Gdynia
Distribution: Mageia 7, SH4, Debian
Posts: 283

Rep: Reputation: 8
Syntax of tcpdump command


I want to catch incoming DHCP requests and incoming ICMP reply from node to server. For this purpose I use such command:

Code:
tcpdump -ln -i eth0 -n udp port 67 or icmp and inbound | grep -e 'MAC address' -e 'IP_address'
Where MAC adres and IP address belongs to the same node, statically assigned by DNSMASQ server.
Is any possibility to made one call of tcpdump without using grep ?
Moreover it any possibility to place several (3 to 5) pairs of MAC address and IP adress (without using grep too)?
 
Old 05-28-2019, 12:10 PM   #2
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 5,140
Blog Entries: 3

Rep: Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551
You'd use the 'ether' specification, if I understand correctly.

Code:
tcpdump -qpli eth0 ether host xx:xx:xx:xx:xx:xx and host aa.bb.cc.dd

Last edited by Turbocapitalist; 05-28-2019 at 12:12 PM.
 
1 members found this post helpful.
Old 05-29-2019, 01:01 AM   #3
mackowiakp
Member
 
Registered: Jun 2014
Location: Poland/Gdynia
Distribution: Mageia 7, SH4, Debian
Posts: 283

Original Poster
Rep: Reputation: 8
Hmm. Still something wrong:

Code:
# tcpdump -li eth0 ether host 90:b6:86:38:46:fa or host 192.168.0.23 -n udp port 67 or icmp and inbound
tcpdump: syntax error
 
Old 05-29-2019, 01:08 AM   #4
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 5,140
Blog Entries: 3

Rep: Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551
Yes, as it says, the syntax is incorrect. The options go before the expression, which must come last.
Code:
tcpdump -nli eth0 \( ether host xx:xx:xx:xx:xx:xx or host aa.bb.cc.dd \) \
        and \( udp port 67 or icmp \) and inbound
Also pay attention to precedence in the formula.

Last edited by Turbocapitalist; 05-29-2019 at 01:11 AM.
 
1 members found this post helpful.
  


Reply

Tags
grep, tcpdump


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
From the command line What is the syntax syntax to import some data into mysql table Glenn D. Linux - Software 1 03-13-2015 09:26 AM
I've found tcpdump tagged as 'Installed' in PPM, why I can't find a tcpdump command ? illidan.modeler Puppy 1 09-07-2013 07:50 AM
Looking for tcpdump syntax to start hex output at a given byte offset in the packet silentquasar Linux - Networking 1 08-06-2011 06:03 AM
BSD firewalls and tcpdump syntax PlatinumX *BSD 2 06-06-2010 06:48 PM
C++ syntax error before :: token HELP, i cant find the syntax error :( qwijibow Programming 2 12-14-2004 06:09 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 07:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration