capture network traffic on two different ports simultaneously

Question

I wish to capture tcpdump traffic on two different ports simultaneouly .

I tried this ..

  $ tcpdump port 21 ; tcpdump port 22

Althoug it worked but problem is first it will wait for traffic on port 21 and when interrupted then it will wait for port 22.

Also another problem is it will not capture the traffic on port 22 untill traffic on port 21 will be captured.

I want an order free solution means in whatever order packet arrives if they are for port 21 or 22 they should be captured .

Please help me on this !!!

EDIT :

Sorry I did not specified it before the actual command I am trying to run is this ..

  $ tcpdump -X -s0 protochain 50

and

  $ tcpdump -X -s0 protochain 51

Now I need to use 50 and 51 both simultaneously ..

Possible duplicate of [Monitoring multiple ports in tcpdump](https://stackoverflow.com/questions/2187932/monitoring-multiple-ports-in-tcpdump) — Vadzim, Nov 28 '18 at 20:02

Daniel Böhmer · Answer 1 · 2016-02-15T17:08:08.160

4

I am no tcpdump expert but found this in the tcpdump manpage:

tcpdump 'gateway snup and (port ftp or ftp-data)'

So try this

tcpdump '(port ftp or ftp-data)'

edited Feb 15 '16 at 17:08

answered Nov 29 '11 at 10:49

Daniel Böhmer

14,463
5
36
46

@UditGupta: You might want to post your own answer to this question if you needed to adapt the code above. Would help others with the same question. – Daniel Böhmer Nov 30 '11 at 10:23

score 4 · Answer 2 · edited Nov 29 '11 at 11:01

4

Hi, you just need to compose two ports like this:

tcpdump -n -i $INTERFACE port 21 or port 22

where -n will get numerical address without reverse resolving (faster)
and $INTERFACE is real interface where you sniff trafic

edited Nov 29 '11 at 11:01

eeerahul

1,629
4
27
38

answered Nov 29 '11 at 10:54

taho

51
1

score 0 · Answer 3 · answered Mar 22 '19 at 03:02

Like other contributors said, you can use the and logical operator, but be aware than you can also use it in conjunction with other operators. To ensure that tcpdump sees them, and that the operator precedence is the one you want, use brackets, but only within single quotes, like in this example below: sudo tcpdump -i eth0 '(port 465 or port 587)' and src 1.2.3.4, because if you omit the single quotes, your shell may interpret them before tcpdump does, and b), you will not be certain of what the operator precedence is to one another. Strong of this, you may now do any combination, just like in arithmetic.

score 0 · Accepted Answer · answered Nov 29 '11 at 11:18

Problem solved it was actually very simple I should have tried it before ..

but thanks I got my idea just by looking at your answers.

I think it is the beauty of stackoverflow if we could find an exact answer , we can invent it through the discussion. ..

 $ tcpdump -X -s0 protochain 50 or 51

capture network traffic on two different ports simultaneously

4 Answers4

Linked