What port does tcpdump use?

What protocol does tcpdump use?

What command line switches does tcpdump use?

Where can I find out more about the source code? Are there any tools/utilities/scripts that could help me with tcpdump usage? Do people think they could have done something else more efficiently, and is my approach acceptable? If so, do you have any tips or suggestions? For instance, how to make it easier to parse the tcpdump log when it's over 50 MB. Or is this a situation where I should just go home, call in sick, and come back with half a day? As an aside, I'm writing these logs to a local SQLite database using sqlite3. It's working well enough, but I'm considering using an XML API instead if there is one. Does anybody know of one for this?
I'd like to add also that writing to local disk doesn't cause any problems because it's only temporary. Writing to the network works fine. The issue comes with parsing.

I'm not sure which switches are used by tcpdump; that said, the documentation is available on tcpdump's website. The source code can be downloaded as part of libpcap. For your purposes, I think you could just as easily use tshark instead.

How do you filter ports in a tcpdump?

It's been a while, I've not used tcpdump before now. The man page and online help page are pretty clear. But how do I filter out ports, ipv4 address's and ipv6 address's in a tcpdump to get all the port information? If there is anything else that I may need to know, or if it's obvious then by the right answers please post it. Thank you for your time. What you're asking for is not actually possible with tcpdump. Tcpdump, by design, cannot analyze packets based on the contents of the headers. Tcpdump is focused on extracting the data contained within those headers (eg IP addresses, port numbers, source and destination IP addresses, source and destination ports, protocol number, etc.).

So, you would have to filter packets in some other way before using tcpdump. For example, you could look at iptables rules.

You can write your own code to perform this filtering. You can simply write your own C program that reads each line of input from stdin and outputs packets only if the appropriate criteria is met. That's relatively simple. As a more elegant approach, however, you could look into using libpcap. The pcap library is a library that allows you to read packets off of a network device, and it includes hooks into the kernel so that you can access the fields in the packets. You could write your own filter to analyze and manipulate the packets before they're read by the libpcap code.