linux下的抓包工具tcpdump

tcpdump的命令格式

[root@u02 ~]# tcpdump --help
tcpdump: unrecognized option '--help'
tcpdump version 4.5.1
libpcap version 1.5.3
Usage: tcpdump [-aAbdDefhHIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
        [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
        [ -i interface ] [ -j tstamptype ] [ -M secret ]
        [ -P in|out|inout ]
        [ -r file ] [ -s snaplen ] [ -T type ] [ -V file ] [ -w file ]
        [ -W filecount ] [ -y datalinktype ] [ -z command ]
        [ -Z user ] [ expression ]

常用方法

抓ping包

# 监听网卡ens160上的ping包
tcpdump -i ens160 icmp

在OpenWrt上的安装

opkg update
opkg install tcpdump