tcpdump: Monitor ALL eth1 Traffic Except My Own SSH Session

by

To monitor all traffic on eth1 except for your own SSH session using tcpdump, you can use the following command:

sudo tcpdump -i eth1 not port 22 and not src <your IP address> and not dst <your IP address>

Here’s what each part of the command does:

  • sudo tcpdump: Run tcpdump with superuser privileges.
  • -i eth1: Monitor traffic on the eth1 interface.
  • not port 22: Exclude traffic to and from port 22, which is used by SSH.
  • not src <your IP address>: Exclude traffic with your own IP address as the source.
  • not dst <your IP address>: Exclude traffic with your own IP address as the destination.

Replace <your IP address> with the IP address of the machine you’re connecting from via SSH. This will exclude traffic to and from your SSH session from the output.

With this command, you will see all traffic on the eth1 interface except your own SSH session. The output will show the source and destination addresses, the protocol used, and any payload data. You can also add other filtering criteria, such as specific protocols or port ranges, using the tcpdump command options.

Leave a Comment