举例：
保存到文件
tcpdump -w xxx.cap(默认抓取eth0的包)
抓eth1的包
tcpdump -i eth1 -w /tmp/xxx.cap
抓到完成的数据包（默认只抓前68字节）
tcpdump -s 0 -w /tmp/xxx.cap
抓192.168.1.123的包
tcpdump -i eth 1 host 192.168.1.123 -w /tmp/xxx.cap
抓取80端口的包
tcpdump -i eth1 port 80 -w /tmp/xxx.cap
抓取范围内的端口
tcpdump -i eth1 portrange 80-82 -w /tmp/xxx.cap
抓192.168.1.123 的 icmp的包
tcpdump -i eth1 host 192.168.1.123 and icmp -w /tmp/xxx.cap
抓192.168.1.123的80端口和22端口之外的其他端口的包
tcpdump -i eth1 host 192.168.1.123 and ! port 80 and ! port 22 -w /tmp/xxx.cap
抓vlan 1的包
tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap
抓pppoe的密码
tcpdump -i eth1 pppoes -w /tmp/xxx.cap
已100m大小分割保存文件，超过100m另开一个文件
tcpdump -i eth1 -C 100m -w /tmp/xxx.cap
抓1000个包后退出
tcpdump -i eth1 -c 1000 -w /tmp/xxx.cap
转自：https://www.cnblogs.com/langdashu/p/5611122.html