How can I use TCPDUMP to determine the top talker on my network? TCPDUMP

This Section

How do I show the MAC address in the capture?
How can I look for the Welchia Worm with TCPDUMP?
How can I show ALL traffic on a specified interface?
How can I capture a specified number of packets?
** Note about these examples and TCPDUMP **
How can I use TCPDUMP to determine the top talker on my network?

How can I use TCPDUMP to determine the top talker on my network?

tcpdump -tnn -c 20000 -i eth0  | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | awk ' $1 > 100 '

Depending on how busy your network is, you might want to lower the `-c 20000' (packet count) to fit your needs. This script will capture 20,000 packets and sort by top talkers.

got feedback?

by state
last modified: 2006-10-14 23:50:16

All FAQs » TCPDUMP » 5. Some simple scripts

How can I use TCPDUMP to determine the top talker on my network?