up vote 0 down vote favorite
share [g+] share [fb]

In Linux can I direct all traffic from a specific ip address or mac address to file.

I am look of a way to take all traffic from a specific ip address or mac address and put it into a file. Does iptables or some other command line level tool let me do this. I know about wireshark which is a great tool, but I looking for a low level command line method to do some thing similar.

I don't really want to install additional software on our servers but would still like to get information about traffic from suspicious IP or mac address. Even if this is in binary. I will write a program to translate it.

link|improve this question
100% accept rate
feedback

2 Answers

up vote 3 down vote accepted

Capture all packets to and from a specific IP address output to a file:

tcpdump -i <interface> host <ip address> -w <filename>

Capture all packets to and from a specific mac address:

tcpdump -i <interface> ether host <mac address> -w <filename>

However, a mac address would be local to your network. If you suspect something untoward is going on with a device on your network, a more direct investigation would likely be more successful. Find it and see what it is doing.

link|improve this answer
superuser.com/q/360227/67952 – nelaar Nov 22 '11 at 13:25
Sure - I suggested the best method for finding it in that question – Paul Nov 22 '11 at 13:26
1  
By the way, the capture files above can be directly opened in wireshark, which is a great tool for interpreting the data found in a capture - also note that wireshark isn't any less low level than tcpdump, so it can be easier to use. – Paul Nov 22 '11 at 13:32
feedback
up vote 1 down vote

If you want to just "see" the traffic and save to file, look into the tcpdump command.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.