capture entire packet
tcpdump -nnvvXSs 1514 -i eth0- nn : don't convert hostnames or port names
- vv : verbosity level
- X : payload. shows packet contents in both ASCII and HEX
- S : prints absolute sequence numbers
- s : set snaplen (in this case 1514)
read entire packet
tcpdump -qns 0 -A -r <filename>- q : quiet
- n : don't convert host names
- s : set snaplen (0 means catch whole packets)
- A : print each packet in ASCII
- r : read from file