Valentine_96813
Nimbostratus
Nimbostratustcpdump with multiple pool members
For years I have always written my tcpdump expression to be client ip and list all pool members using an 'or' statement to capture the "whole" conversation like:
tcpdump -nni 0.0 host 1.1.1.1 or host 2.2.2.1 or host 2.2.2.2 or host 2.2.2.3
This requires you to filter for the stream number in wireshark so you can discard the extra pool members you did not talk to. My question is, is there a way to change to an 'and' statement here using brackets or something like:
tcpdump -nni 0.0 host 1.1.1.1 and (host 2.2.2.1 or host 2.2.2.2 or host 2.2.2.3)
This way you only see your stream and you have a much smaller file size to work with.
