tcpdump-wiki

加 -S 据说会显示理详细的信息。 -nnvv可以默认开启， -xx 比较关键， 不管是小写还是大写。一个 x 的时候，数据链路层的头可能就不会显示出 来。建议都加上。

     tcpdump -nnvvS -XX -i any  icmp

参考 这里 。

  tcpdump -w troubleshoot.pcap -vv -A -T snmp -s 0 "(dst port 162) or (src port 161) or (dst port 161) and (host <SpectroSERVER IP>)"

interface弄成any就可以了：

     sudo tcpdump -i any

Use TCPDUMP to Monitor HTTP Traffic

• show detail

         tcpdump -s 1024 -l -A -n -i eth0 port 80
  

• show headers

         tcpdump -s 1024 -l -A -n -i eth0 port 80
  

• To monitor HTTP traffic including request and response headers and message body:

         tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
  

• To monitor HTTP traffic including request and response headers and message body from a particular source:

         tcpdump -A -s 0 'src example.com and tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
  

• To monitor HTTP traffic including request and response headers and message body from local host to local host:

         tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i lo