zoukankan      html  css  js  c++  java
  • tcpdump示例

    今天有需求要用tcpdump,给一个我使用的例子:

    sudo /usr/sbin/tcpdump  dst 10.20.137.24 and tcp port 8080 -A -s0  -w nouse 

    -A 表示只用ASCII码显示, 方便查看网页

    -x 表示用16进制

    -X 表示16进制和ASCII码同时显示 

    -s0 表示不限制包的大小

    -w 表示写入文件

    参考了下面的文章,不胜感激。 

    Let assume ,I wanna capture tcp packets that flow over eth1 port 6881. The dump file with be save as test.pcap.

    tcpdump -w test.pcap -i eth1 tcp port 6881

    Simple right? What if at the same time I am interested on getting packets on udp port 33210 and 33220?

    tcpdump -w test.pcap -i eth1 tcp port 6881 or udp \( 33210 or 33220 \)
     

         ‘\’ is an escape symbol for ‘(’ and ‘)’. Logic OR implies PLUS (+). In plain text is I want to capture tcp packets flows over port 6881 plus udp ports 33210 and 33220.

    Careful with ‘and’ in tcpdump filter expression, it means intersection. Thats why I put ‘or’ instead of and within udp port 33210 and 33220. The usage of ‘and’ in tcpdump will be illustrate later.

    Ok, how about reading pcap that I saved previously?

    tcpdump -nnr test.pcap

    The -nn is to tell tcpdump not to resolve DNS on IP and Ports, where r is read.

    Adding -tttt to makes the timestamp appears more readable format.

    tcpdump -ttttnnr test.pcap

    How about capture based on IP ?
    You need to tell tcpdump which IP you are interested in? Destination IP? or Source IP ? Let say I wanna sniff on destination IP 10.168.28.22 tcp port 22, how should i write?

    tcpdump -w test.pcap dst 10.168.28.22 and tcp port 22

    So the ‘and’ makes the intersection of destination IP and port.

    By default the sniff size of packets is 96 bytes, you somehow can overload that size by specified with -s.

    tcpdump -w test.pcap -s 1550 dst 10.168.28.22 and tcp port 22

    Some version of tcpdump allows you to define port range. You can as bellow for capturing packets based on a range of tcp port.

    tcpdump tcp portrange 20-24

    Bare in mind, the line above I didn’t specified -w which it won’t write to a file but i will just print the captured packets on the screen.

  • 相关阅读:
    Java接口自动化测试实战001----get、post方法实现与封装
    临近年关,两个磁盘占满引起的服务下线
    Abp小试牛刀之 图片上传
    Abp vNext异常处理的缺陷/改造方案
    Oh my God, Swagger API文档竟然可以这样写?
    【C#】DockPanelSuite 中 DockState.Document 状态下子窗体控件不显示的解决方案
    环境系列——cygwin启动flink
    环境系列——window10环境下编译Flink源码编译
    弱肉强食——《哆啦A梦:大雄的新恐龙》观后感
    bilibili插件推荐
  • 原文地址:https://www.cnblogs.com/welkinwalker/p/1954993.html
Copyright © 2011-2022 走看看