Loading...

My Account

Log In

Knowledge Center

Ondersteuning voor FireEye-producten

How to enable TCPDUMP on Trellix Linux Operating System

Technical Articles ID: KB94134
Last Modified: 2023-02-02 05:08:20 Etc/GMT

Environment

Trellix Linux Operating System (TLOS)

Summary

Download the latest TCPDUMP rpm files from here.

NOTE: The current latest version available is 4.9.2-6.
tcpdump-4.9.2-6.mlos3.x86_64.rpm 09-Sep-2022 20:32 419K
Connect to the TLOS appliance via a remote console or SSH.
Log on with root user.
Install the RPM:
Type rpm -ivh /tmp/tcpdump-4.9.2-6.mlos3.x86_64.rpm and press Enter.
Capture the data:
Type tcpdump -i any -w /tmp/tcpdump.pcap and press Enter.

tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
^C2299 packets captured
5299 packets received by filter
914 packets dropped by kernel
bash-4.1#

NOTE:
- -i indicates Interface
- -w Indicates File count
- More switches to capture the dump are documented in the official Red Hat site.

Affected Products

Languages:

This article is available in the following languages: