The tcpdump utility's interface or -i option accepts only one option. This is a very important switch to use and is usually missed, resulting in a truncated packet capture which won't be useful for network analysis.įollowing are examples of commands used to run the tcpdump utility: Selecting an Interface or VLAN And most importantly, this will save the output in a binary file which you will need to get off the device and then open with Wireshark or a similar Network analysis tool.Īlso if you need to provide the packet capture to F5 Support, they will ask you to use -w option to save the packet capture on a file and the -s0 option which indicates tcpdump to save the whole packet. However, if you are troubleshooting a difficult networking issue and you need to get a packet capture to later one perform packet analysis with a tool like Wireshark, then run tcpdump using the -w option. If you want to perform a quick check and see if the packets are going thru the device, but you don't need to perform deep packet capture inspection then running tcpdump without -w option is fine. There are basically two main ways of running tcpdump, without saving the packet capture on a file (without the -w option) and the other is saving the packet capture on a. TCPDUMP is the best tool you can use for troubleshooting networking issues To understand the basics of tcpdump will prove extremely helpful for your troubleshooting sessions. When working with F5 devices (and other networking devices as well) tcpdump is the best tool you can use for troubleshooting networking issues or getting an understanding of a particular traffic flow.

F5 tcpdump wireshark