如何使用 tcpdump 分析网络报文

yum install tcpdump //tcpdump安装

捕获及停止条件 

• -D 列举所有网卡设备
• -i 选择网卡设备
• -c 抓取多少条报文
• --time-stamp-precision 指定捕获时的时间精度，默认毫秒 micro，可选纳秒 nano • -s 指定每条报文的最大字节数，默认 262144 字节

$ tcpdump -i en0 host www.baidu.com and port 443 -c 10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on en0, link-type EN10MB (Ethernet), capture size 262144 bytes
07:09:43.197939 IP 172.19.108.85.55723 > 180.101.49.12.https: Flags [.], seq 3256827061:3256828513, ack 1682365603, win 4096, length 1452
07:09:43.197943 IP 172.19.108.85.55723 > 180.101.49.12.https: Flags [P.], seq 1452:2180, ack 1, win 4096, length 728
07:09:43.211985 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [.], ack 1452, win 1220, length 0
07:09:43.211992 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [.], ack 2180, win 1312, length 0
07:09:43.702570 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [.], seq 1:1461, ack 2180, win 1312, length 1460
07:09:43.702574 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [P.], seq 1461:1700, ack 2180, win 1312, length 239
07:09:43.702577 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [.], seq 1700:3160, ack 2180, win 1312, length 1460
07:09:43.702578 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [.], seq 3160:4620, ack 2180, win 1312, length 1460
07:09:43.702581 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [P.], seq 4620:4684, ack 2180, win 1312, length 64
07:09:43.702582 IP 180.101.49.12.https > 172.19.108.85.55723: Flags [.], seq 4684:6144, ack 2180, win 1312, length 1460
10 packets captured
205 packets received by filter
0 packets dropped by kernel

 

 

tcpdump -i en0  -C 1 -W 3 -w a.pcap //-C表示1M大小就换文件 -W 指定最大数量 

tcpdump -i en0 -G 3 -w file%M-%S //-G 表示每隔3秒输出一个文件 后面的%M-%S 格式表示动态的文件 以分钟-秒来显示