Enter the name of the network interface on which to capture packets.

The following values are accepted:

• port1

• port2

• port3

• port4

• any

Enter any to capture packets on all interfaces.

Enter none to capture all packets, or enter a filter that specifies which protocols and port numbers to capture, such as tcp port 25. Surround the filter string in quotes.

The filter uses the following syntax:

'[[src|dst] host {<host1_fqdn> | <host1_ipv4>}] [and|or] [[src|dst] host {<host2_fqdn> | <host2_ipv4>}] [and|or] [[arp|ip|gre|esp|udp|tcp] port <port1_int>] [and|or] [[arp|ip|gre|esp|udp|tcp] port <port2_int>]'

To display only the traffic between two hosts, specify the IP addresses of both hosts. To display only forward or only reply packets, indicate which host is the source and which is the destination.

For example, to display UDP port 1812 traffic between 1.example.com and either 2.example.com or 3.example.com, use the following filter:

'udp and port 1812 and src host 1.example.com and dst ( 2.example.com or 2.example.com )'

Enter the number of packets to capture.

Enter the timestamp format to use in the output. Enter one of the following:

• a: Absolute UTS time (yyyy-mm-dd hh:mm:ss.ms)

• r: Relative to the start of sniffing (hh:mm:ss.ms)