Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Linux can I direct all traffic from a specific ip address or mac address to file.

I am look of a way to take all traffic from a specific ip address or mac address and put it into a file. Does iptables or some other command line level tool let me do this. I know about wireshark which is a great tool, but I looking for a low level command line method to do some thing similar.

I don't really want to install additional software on our servers but would still like to get information about traffic from suspicious IP or mac address. Even if this is in binary. I will write a program to translate it.

share|improve this question
up vote 3 down vote accepted

Capture all packets to and from a specific IP address output to a file:

tcpdump -i <interface> host <ip address> -w <filename>

Capture all packets to and from a specific mac address:

tcpdump -i <interface> ether host <mac address> -w <filename>

However, a mac address would be local to your network. If you suspect something untoward is going on with a device on your network, a more direct investigation would likely be more successful. Find it and see what it is doing.

share|improve this answer – nelaar Nov 22 '11 at 13:25
Sure - I suggested the best method for finding it in that question – Paul Nov 22 '11 at 13:26
By the way, the capture files above can be directly opened in wireshark, which is a great tool for interpreting the data found in a capture - also note that wireshark isn't any less low level than tcpdump, so it can be easier to use. – Paul Nov 22 '11 at 13:32

If you want to just "see" the traffic and save to file, look into the tcpdump command.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .