How to capture traffic between two specific hosts with tcpdump

How to capture traffic between two specific hosts with tcpdump

Filter tcpdump captures to show only traffic between two specific IP addresses.

Prerequisites

• tcpdump installed with root or sudo access.

Step-by-Step: Capture Traffic Between Hosts with tcpdump

1. Use the host filter with and to capture bidirectional traffic between two IPs:

   sudo tcpdump -i eth0 host 10.0.0.1 and host 10.0.0.2

2. Restrict to a specific protocol:

   sudo tcpdump -i eth0 host 10.0.0.1 and host 10.0.0.2 and tcp

3. Restrict to a specific port:

   sudo tcpdump -i eth0 host 10.0.0.1 and host 10.0.0.2 and port 5432

4. Disable hostname resolution for faster output:

   sudo tcpdump -nn -i eth0 host 10.0.0.1 and host 10.0.0.2