2

I have not had much luck in finding a way for tcpdump to filter by the application layer protocol, like HTTP or FTP. It seems it can filter by at most transport layer protocols like TCP or UDP: https://linux.die.net/man/7/pcap-filter

Is it true tcpdump does not have the functionality to examine and identify application layer protocol headers, like Wireshark does?

flow2k
  • 3,999
  • 40
  • 55

1 Answers1

3

tcpdump use the pcap filters syntax and allows you to filter by port with:

tcp port 80

or

tcp port 21

If you want to filter by application layer protocol, you will have to use TShark. With this tool you can use capture filters with the same syntax as pcap filters but also display filters which allow you to filter by application layer protocol with:

http

or

ftp
Ortomala Lokni
  • 56,620
  • 24
  • 188
  • 240