tcpdump command and options- Performance Measurement commands for Unix

tcpdump - dump traffic on a network. Tcpdump  prints  out a description of the contents of packets on a network interface that match the boolean expression.

Type the following command:

$tcpdump

You need to interrupt the command else it would keep scrolling

http://unix.stackexchange.com/questions/82919/what-does-the-eth0-interface-name-mean-in-linux

OPTIONS

-i interface

--interface=interface Listen on interface.  If unspecified, tcpdump searches the system interface list for the lowest numbered,  configured  up  interface (excluding loopback), which may turn out to be, for example, ``eth0''.

    $tcpdump -i eth0

-c count

             Exit after receiving count packets.

$tcpdump -c 30 -i eth0

-D

--list-interfaces, prints  the list of the network interfaces available on the system and on which tcpdump can capture packets.  For each network interface, a number and an interface name, possibly followed by a text description of the interface, is printed.  The interface  name  or the number can be supplied to the -i flag to specify an interface on which to capture.

    $tcpdump -D

-w file

Write the raw packets to file rather than parsing and printing them out.  They can later be printed with the -r option.

    $tcpdump -w dump01.pcap -c 10 -i eth0

and now read the dumped file -

$tcpdump -r dump01.pcap

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.   

$tcpdump -n

To capture packets from specific port, specify port number -

$tcpdump -i eth0 port 22

To capture packets from specific source -

      $tcpdump -i eth0 src 192.168.1.1