tcpdump filtering remote interface

[benshafat]

Hi All,

I'm trying to capture traffic between two machines, A and B. I would like to make sure that the traffic I capture with tcpdump is between eth1 on the local machine and eth0 on the remote machine. As I understand it, the -i flag specifies the local machine interface - but how to set the remote one?

Thanks

Elisha

[Irithori]

Not possible.

But if you dont trust your routing or the traffic, that you receive on one side, then you can run a second tcpdump locally on that remote machine.

[HROAdmin26]

Google: tcpdump examples

You cannot filter on one machine by the device name on another machine (how would the local machine know what device name is on another system?) But you can filter tcpdump by the remote IP address.

# host // look for traffic based on IP address (also works with hostname if you're not using -n)

# tcpdump host 1.2.3.4

[benshafat]

Thanks. I should have known it was impossible. Don't know why I thought the hardware info was encoded in the packets.