tcpdump with multiple dst IP addresses?

Question

Can I specify more than 1 dst ip address for tcpdump? If not, how shall I filter the information nicely if I only want the traffic for two specific destinations? Thank you very much!

Answer 1

Yes, you could have a filter with multiple "dst host XXX.XXX.XXX.XXX" clauses connected by "or", such as "dst host 192.9.200.1 or dst host 192.9.200.2".

Answer 2

Yes you can add multiple source or destination ip addresses for tcpdump as a filter to your capture. Use "dst host XXXXXX or dst host XXXXX or dst host XXXX" as a filter after your tcpdump command.

you can find several other filters with example on: http://rationallyparanoid.com/articles/tcpdump.html