tcpdump filter examples

I'm looking for some tcpdump filter examples.
Say I am ssh'ed into machine foo and want to capture everything
without all the ssh packets. How would I filter out all the ssh
packets and simply view the remaining traffic sans ssh packets created
by my connection?
Also, say I want to restrict tcpdump to a single protocol and host.
Meaning, I want to filter on port 80 all traffic from machine foo. I
want foo to be both the source and destination and want to see all
outgoing and incoming requests. But no other traffic on my network.
Thanks much.
KJ

> I'm looking for some tcpdump filter examples.
> Say I am ssh'ed into machine foo and want to capture everything
> without all the ssh packets. How would I filter out all the ssh
> packets and simply view the remaining traffic sans ssh packets created
> by my connection?

Try:

tcpdump not port ssh
tcpdump host hostname and not port ssh
tcpdump host hostname and port ssh

--
Jem Berkes
http://www.sysdesign.ca/

Jem Berkes <(E-Mail Removed)9__org> wrote:
> > I'm looking for some tcpdump filter examples.
> > Say I am ssh'ed into machine foo and want to capture everything
> > without all the ssh packets. How would I filter out all the ssh
> > packets and simply view the remaining traffic sans ssh packets created
> > by my connection?

> Try:

> tcpdump not port ssh
> tcpdump host hostname and not port ssh
> tcpdump host hostname and port ssh

In addition the OP should try 'info tcpdump' there are a bunch of
examples.

--
Michael Heiming

Remove +SIGNS and www. if you expect an answer, sorry for
inconvenience, but I get tons of SPAM

Excellent. And here I was thinking I had to do something with the TCP
flag bytes, (tcp[13] & 0x10 != 0). Thanks for reminding me about the
simplicity of tcpdump filters.
KJ

Jem Berkes <(E-Mail Removed)9__org> wrote in message news:<Xns9418B869E54A9jbuserspc9org@205.200.16.73> ...
> > I'm looking for some tcpdump filter examples.
> > Say I am ssh'ed into machine foo and want to capture everything
> > without all the ssh packets. How would I filter out all the ssh
> > packets and simply view the remaining traffic sans ssh packets created
> > by my connection?
>
> Try:
>
> tcpdump not port ssh
> tcpdump host hostname and not port ssh
> tcpdump host hostname and port ssh