tcpdump

Just a write up of the filters I sometimes use/need.
(work in progress…)

Filtering _out_ ssh:
tcpdump "port ! ssh"

Just seeing ICMP packets:
tcpdump "icmp"

Filtering on port _and_ host:
tcpdump "port ssh && host host-name"