tcpdump

Capture tcpdump on any physical interface of Intelligent Sandbox.

Syntax: tcpdump <parameter>

Post tcpdump capture, the binary pcap files can be downloaded from Intelligent Sandbox web UI. File name: atd_netdata.zip.
The maximum pcap file size is limited to 10 MB. The maximum pcap file count is limited to 25 files.
Maximum file size: Once, the maximum size is reached tcpdump automatically begins recording to a new file.
Maximum file count: Once, the maximum count is reached, tcpdump automatically overwrites the first and subsequent log file until the user stops the capture.

Parameter	Description
start	Starts the packet capture operation on the specified tcp dump. You can set custom port option using the following syntax: `tcpdump start <interface> <port options sepearted by underscore>` Note `<interface>` is a required parameter. Interface value should be eth0, eth1, eth2, or eth3. Example: `tcpdump start eth0 host_8.8.8.8` To set multiple filters, use `and` and `or` operators separated by underscores. Example: `tcpdump start eth0 host_8.8.8.8_and_port_53`
stop	Stops the packet capture operation.
clean	Removes tcpdump results and .zip files.
listfiles	Displays tcpdump output files.
ls	Displays tcpdump output files.
save	Saves .zip archive of tcpdump results to atdadmin account.
status	Displays tcpdump progress status.
view	Displays tcpdump results.