Filtering Full-Content Data

In situations where you are collecting too much traffic for your monitoring system to handle, you will need to filter the full-content data. The simplest way to implement filtering in tcpdump relies on building Berkeley Packet Filters. The tcpdump manual page offers numerous options for pointing the tool’s attention toward specific packets.

During computer security incidents, we often depend on watching traffic either from hosts of interests or to hosts of interests. For example, to record all traffic to or from the 12.44.56.0/24 network block, we would use the following command line: