Network Monitoring Analysis Tcpdump Redhat Linux Command Rhel5

Tcpdump is a command-line tool for monitoring network traffic..

Tcpdump command capture and display the packet headers on a particular network interface (eth0 ,eth1) or on all interfaces.
Tcpdump used for capturing Linux Networking File
In another word it is used to listed and record the Network traffic.
This command is highly used in the Network Trouble Shooting and Network Analysis Process.
Linux system Network traffic dumped on the screen.
To capture that file use the following command

# tcpdump -i eth0 -w traffic.eth0
-i refer to the Interface – Ethernet Interface
-w used to save the packed data
-r is used to read that saved packet data
#tcpdump –r traffic.eth0

Tcpdump Command is Used To Identify DOS Attack Denial of Service Attack.
DOS – Denial of Service Attack: the hacker or unauthorized user they try to increase the server traffic. For these reason it will slow down the site traffic
Rhel5 Command Identify the Denail of Service Attach
[root@script]#tcpdump –i eth0 dst port 80
port 80 it is refer to http

If any large request increase form the Same IP Address we will confirm that is DOS attack.Tcpdump is Linux command is mainly used for Maintain Network analysis.
By Using Port Number we can analysis Required Network Packages. It will reduce the
Loading and processing time of packet analysis.

Inter Face eth0, Port Number  2086. dump packet analysis stored in networkmonitor.cpac
[root@bashscript]#tcpdump -w networkmonitor.cpac -i eth0 tcp port 2086

Capture the Packet Using IP Address
#tcpdump -w networkmonitor.cpac dst 10.0.0.2 and tcp port 2086