tcpdump

# Type Qualifier
host, net, port, portrange

tcpdump -v net 12.12.12.0 mask 255.255.255.0 
tcpdump -v net 12.12.12.0/24  or tcpdump -v net 11.11.11   #capture from /24 network
tcpdump -v host 33.33.33.33

tcpdump -v port 80  - capture all traffic to-or-from port 80
tcpdump -v portrange 21-80


# Directional Qualifier
src, dst, src or dst, src and dst

tcpdump -v  src 1.1.1.1 . (show pkt COMING from 1.1.1.1 only)
tcpdump -v dst 1.1.1.1 (show pkt Going to 1.1.1.1)

#Protocol Qualifier(ip,ip6,tcp,udp,icmp,ether)
eg. arp - IP to MAC resolution

tcpdump -v arp  -  show arp
tcpdump -nv ether broadcast  - shows ethernet broadcast traffic(ipp, arp traffic)
/etc/services --ipp is used to convert port number to names

tcpdump -nnv udp
tcpdump -nnv icmp

tcpdump src host 192.168.75.1 and dst port 22   - reveals TCP:22 or UDP 22 sourced/Coming from  192.168.75.1

tcpdump dst host 1.1.2.2 and dst port 22
tcpdump -c 1      # count capture 1 packet and exit
tcpdump -n -r filename.dump not port 5901 . ##exclude packet to/from 5901 tcp/udp port


iostat -xnz 1