Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In Linux can I direct all traffic from a specific ip address or mac address to file.

I am look of a way to take all traffic from a specific ip address or mac address and put it into a file. Does iptables or some other command line level tool let me do this. I know about wireshark which is a great tool, but I looking for a low level command line method to do some thing similar.

I don't really want to install additional software on our servers but would still like to get information about traffic from suspicious IP or mac address. Even if this is in binary. I will write a program to translate it.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Capture all packets to and from a specific IP address output to a file:

tcpdump -i <interface> host <ip address> -w <filename>

Capture all packets to and from a specific mac address:

tcpdump -i <interface> ether host <mac address> -w <filename>

However, a mac address would be local to your network. If you suspect something untoward is going on with a device on your network, a more direct investigation would likely be more successful. Find it and see what it is doing.

share|improve this answer
    
superuser.com/q/360227/67952 –  nelaar Nov 22 '11 at 13:25
    
Sure - I suggested the best method for finding it in that question –  Paul Nov 22 '11 at 13:26
1  
By the way, the capture files above can be directly opened in wireshark, which is a great tool for interpreting the data found in a capture - also note that wireshark isn't any less low level than tcpdump, so it can be easier to use. –  Paul Nov 22 '11 at 13:32

If you want to just "see" the traffic and save to file, look into the tcpdump command.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.