The command parameter to save the capture package to the file is -w xxx.cap

grab eth1 Bag of  
tcpdump -i eth1 -w /tmp/xxx.cap

grab Bag of  
tcpdump -i eth1 host -w /tmp/xxx.cap

grab Of 80 Packets for port  
tcpdump -i eth1 host and port 80 -w /tmp/xxx.cap

The target address is Of 80 Packets for port  
tcpdump -i eth1 dst and port 80 -w /tmp/xxx.cap

grab Of icmp Bag of  
tcpdump -i eth1 host and icmp -w /tmp/xxx.cap

grab eth1 wrong arp,rarp Bag of
tcpdump -i eth1 not arp and not rarp

Display in packet capture log IP, No IP analysis
tcpdump -i eth1 -n

grab Of 80 Ports and 110 and 25 Packets from other ports than  
tcpdump -i eth1 host and ! port 80 and ! port 25 and ! port 110
-w /tmp/xxx.cap

grab vlan 1 Bag of  
tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap

grab pppoe Password for  
tcpdump -i eth1 pppoes -w /tmp/xxx.cap

Use readable timestamps
tcpdump -tttt -i eth1

with 100m Size split save file , exceed 100m Open another file -C 100m

grab 10000 Exit after packages -c 10000

Grab greater than / less than N bytes Bag of
tcpdump -i eth1 greater 1024
tcpdump -i eth1 less 1024

Backstage bag grabbing , Console exit will not affect either : 
nohup tcpdump -i eth1 port 110 -w /tmp/xxx.cap &

The captured documents can be used directly ethereal perhaps wireshark open .

Daily Recommendation
views 214
views 191
views 181