tcpdump command for multiple source hosts and destination hosts

The parameters to tcpdump I usually use are

tcpdump -i 0.0 -nn -p -e "thefilter"

where in your case "thefilter" would be something like

"(port 80 or port 443) and ((host 172.17.30.100 or host 172.17.30.101 or host 172.17.30.102) and ((host 172.17.31.200 or host 172.17.31.201 or host 172.17.31.202))"

Note that there's multiple ways to create a filter (As long as the syntax is correct and the logic OK they'll all work).

Note also this one will simoly list all the packet headers (Including VLAN) to the screen. If you want to save the packets out to a dumpfile for later analysis by something like wireshark, or decrypting with ssldump I'd use something like

tcpdump -i 0.0:nnn -p -s0 -w "somefilename" "thefilter"

to save the file out to "somefilename". Note the '-p' is an affectation more than anything else these days, especially with BigIP. It simply tells tcpdump not to put the interface into promiscuous mode. But I leave it there by force of habit 🙂

H