tcpdump filter src dst port

Question

I need to sniff voip traffic on 5060 port. And at the same time I need to exclude all packets where src port 5060 and dst port 5061

I need something like:

tcpdump -i any -vvv -s0 port 5060 and (not src port 5060 and not dst port 5061)

but the second part of the filter should be related to a single packet, not all traffic. How can I do that?

So you want to see all traffic to or from port 5060, except for traffic that's from port 5060 and to port 5061? — user862787

Unknown Unknown · Accepted Answer · 2014-05-22T16:25:33

7

votes

Try

port 5060 and not (src port 5060 and dst port 5061)