Capture inbound packets only
For example, with tcpdump, on some platforms something like tcpdump -i eth0 -Q in will capture inbound traffic on eth0. Is there something similar for tshark
How about this:
tshark -i 1 -f "ether dst 00:11:22:33:44:55"
-i specifies the interface. You might want to change the number to something that matches your needs. Use tshark -D to list all interfaces
Or use the 'any' pseudo interface in case of Linux, in combination with the BPF filter inbound (or ether[10] != 4 on older versions)
This means 'Linux cooked' header / packet type is not 'Sent by us', thus incoming unicast/broadcast/multicast traffic.
tshark -w file.pcapng -i any inbound
Or similarly not ether src <my-mac>
Asked: 2023-01-02 01:34:50 +0000
Seen: 1,664 times
Last updated: Jan 02 '23
What operating system?
On linux (YMMV), you could use
inboundoroutboundas a capture filter:pcap-filter.7 man page
Open issue to implement in
npcapon Windows:248: Support pcap_setdirection() for filtering packets by direction (sent or received)
Note that the "filtering" in "Support pcap_setdirection() for filtering packets by direction (sent or received)" is not filtering with a capture filter expression, it's filtering in a program that explicitly calls
pcap_setdirection(), which tcpdump does (that's how-Qis implemented), but Wireshark does not.inbound"compiles" on Ubuntu with Wireshark 3.5.0rc0. Is that a bug?No. As @Chuckc said, "On linux (YMMV), you could use
inboundoroutboundas a capture filter:"