Capturing packets using tcpdump for viewing using Wireshark
https://www.wireshark.org/docs/wsug_html_chunked/AppToolstcpdump.html
Filtering
-
Type your filter in the text box near the top that says Apply a display filter and press Enter
-
Filter by source IP:
ip.src==192.168.0.1
-
Filter by destination IP:
ip.dst==192.168.0.1
-
Combine filters using and/or:
ip.src==192.168.0.1 and ip.dst==192.168.0.1 ip.src==192.168.0.1 or ip.dst==192.168.0.1
View absolute dates/times instead of relative
View > Time Display Format > Date and Time of Day
Traffic flow graph
Statistics > Flow Graph
Show one specific connection/session from start to finish
-
Right-click one of the packets in the connection > Follow > TCP Stream
-
A window will pop up with the TCP stream contents, which you can close