tcpdump命令

　　tcpdump是Linux下强大的抓包工具，不仅可以分析数据包流向，还可以对数据包内容进行监听。通过分析数据包流向，可以了解一条连接是如何建立双向连接的。
　　tcpdump允许用户（一般是root）拦截和显示发送或收到过网络连接到该计算机的TCP/IP和其他数据包。

1 用法及常用参数一览

tcpdump [-AennqX] [-i 接口] [-w 存储文件名] [-c 次数] [-r 文件] [所要抓取的数据包格式]
常用选项与参数：
-A    # 数据包的内容以ASCII显示，通常用来抓取WWW的网页数据包
-e    # 使用数据链路层（osi第2层）的MAC数据包数据来显示
-nn   # 直接以IP及port显示，而不用主机名与服务名显示
-q    # 列出较为简短的数据包信息，每一行内容比较精简
-X    # 列出十六进制（hex）以及ASCII数据包内容，对于监听数据包内容很有用
-i    # 后接要监听的网络接口，如eth0/eth1/lo/ppp0等
-w    # 后接文件名，将监听的数据包数据存储到文件中
-r    # 后接文件名，从文件中读出数据，这个文件必须存在，且是由-w所产生的
-c    # 监听的数据包数，如果没有这个参数，tcpdump会一直监听，直到按Ctrl+C为止

'host 127.0.0.1'   # 针对单台主机抓包
'net 192.168'      # 针对某个网络抓包
'src host 127.0.0.1' 'dst net 192.168'  # 同时加上源（src）和目标限制（dst）
'tcp port 21'      # 针对通信协议（tcp/udp/arp/ether）、端口检测

还可以利用and 与 or 进行数据包的整合显示

　

2 常用命令示例

　(1) 查看某块网卡的80端口数据包流向

[@bjzw_11_210 logs]# tcpdump -i eth1 port 80 -nn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
13:47:06.904009 IP 10.149.35.123.52723 > 10.146.11.210.80: S 2680202536:2680202536(0) win 14600 <mss 1460>
13:47:06.904155 IP 10.146.11.210.80 > 10.149.35.123.52723: S 1981317955:1981317955(0) ack 2680202537 win 5840 <mss 1460>
13:47:06.905537 IP 10.149.35.123.52723 > 10.146.11.210.80: . ack 1 win 14600
13:47:06.905573 IP 10.149.35.123.52723 > 10.146.11.210.80: P 1:1045(1044) ack 1 win 14600
13:47:06.905579 IP 10.146.11.210.80 > 10.149.35.123.52723: . ack 1045 win 8352
13:47:06.908920 IP 10.146.11.210.80 > 10.149.35.123.52723: P 1:268(267) ack 1045 win 8352
13:47:06.908943 IP 10.146.11.210.80 > 10.149.35.123.52723: F 268:268(0) ack 1045 win 8352
......
13:47:09.275055 IP 10.148.40.118.64051 > 10.146.11.210.80: S 2641310142:2641310142(0) win 14600 <mss 1460,nop,wscale 8>
13:47:09.275080 IP 10.146.11.210.80 > 10.148.40.118.64051: S 1613833543:1613833543(0) ack 2641310143 win 5840 <mss 1460>
13:47:09.277054 IP 10.148.40.118.64051 > 10.146.11.210.80: . ack 1 win 14600
13:47:09.277094 IP 10.148.40.118.64051 > 10.146.11.210.80: P 1:894(893) ack 1 win 14600
13:47:09.277102 IP 10.146.11.210.80 > 10.148.40.118.64051: . ack 894 win 7144
13:47:09.280479 IP 10.146.11.210.80 > 10.148.40.118.64051: P 1:268(267) ack 894 win 7144
13:47:09.280523 IP 10.146.11.210.80 > 10.148.40.118.64051: F 268:268(0) ack 894 win 7144
13:47:09.282447 IP 10.148.40.118.64051 > 10.146.11.210.80: . ack 268 win 15544
13:47:09.282672 IP 10.148.40.118.64051 > 10.146.11.210.80: F 894:894(0) ack 269 win 15544
13:47:09.282699 IP 10.146.11.210.80 > 10.148.40.118.64051: . ack 895 win 7144

530 packets captured                        <== 捕获的数据包数量
530 packets received by filter              <== 通过过滤所得的总数据包数量
0 packets dropped by kernel                 <== 被内核所丢弃的数据包
[@bjzw_11_210 logs]#

分析其中标红哪行的含义（如果第一次看肯定看晕）：

13:47:09.277094      捕获该数据包的时间，单位为“时：分：秒”；
IP                   通信协议是IP；
10.148.40.118.64051  传送段的ip和端口分别是10.148.40.118和64051；
>                    数据包的传输方向（流向）；
10.146.11.210.80     接收端的ip和端口分别是10.146.11.210和80；
P 1:894(893)         该数据包带有PUSH传输标志，且传输的是整体数据的1~894 bytes;
ack 1                ack相关的资料；          
win 14600            窗口大小为14600字节。

(2) 本机执行tcpdump -i lo -nn;另一个窗口登录试试本机

[root@localhost ~]# tcpdump -i lo -nn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
04:16:47.369125 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [S], seq 765824415, win 43690, options [mss 65495,sackOK,TS val 9866687 ecr 0,nop,wscale 7], length 0
06:24:59.562849 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [S.], seq 1387677067, ack 765824416, win 43690, options [mss 65495,sackOK,TS val 9866687 ecr 9866687,nop,wscale 7], length 0
04:16:47.369260 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 1, win 342, options [nop,nop,TS val 9866687 ecr 9866687], length 0
04:16:47.386090 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 1:24, ack 1, win 342, options [nop,nop,TS val 9866704 ecr 9866687], length 23
04:16:47.386108 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [.], ack 24, win 342, options [nop,nop,TS val 9866704 ecr 9866704], length 0
04:16:47.390350 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 1:24, ack 24, win 342, options [nop,nop,TS val 9866708 ecr 9866704], length 23
04:16:47.390376 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 24, win 342, options [nop,nop,TS val 9866708 ecr 9866708], length 0
04:16:47.391295 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 24:1992, ack 24, win 342, options [nop,nop,TS val 9866709 ecr 9866708], length 1968
04:16:47.397549 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 24:1664, ack 1992, win 1365, options [nop,nop,TS val 9866715 ecr 9866709], length 1640
04:16:47.397580 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 1664, win 1365, options [nop,nop,TS val 9866715 ecr 9866715], length 0
04:16:47.400135 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 1992:2040, ack 1664, win 1365, options [nop,nop,TS val 9866718 ecr 9866715], length 48
04:16:47.408615 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 1664:1944, ack 2040, win 1365, options [nop,nop,TS val 9866726 ecr 9866718], length 280
04:16:47.448039 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 1944, win 1391, options [nop,nop,TS val 9866766 ecr 9866726], length 0
04:16:49.841492 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2040:2056, ack 1944, win 1391, options [nop,nop,TS val 9869159 ecr 9866726], length 16
04:16:49.881209 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [.], ack 2056, win 1365, options [nop,nop,TS val 9869199 ecr 9869159], length 0
04:16:49.881259 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2056:2108, ack 1944, win 1391, options [nop,nop,TS val 9869199 ecr 9869199], length 52
04:16:49.881271 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [.], ack 2108, win 1365, options [nop,nop,TS val 9869199 ecr 9869199], length 0
04:16:49.881467 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 1944:1996, ack 2108, win 1365, options [nop,nop,TS val 9869199 ecr 9869199], length 52
04:16:49.881484 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 1996, win 1391, options [nop,nop,TS val 9869199 ecr 9869199], length 0
04:16:49.881691 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2108:2176, ack 1996, win 1391, options [nop,nop,TS val 9869199 ecr 9869199], length 68
04:16:49.884696 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 1996:2080, ack 2176, win 1365, options [nop,nop,TS val 9869202 ecr 9869199], length 84
04:16:49.892264 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2176:2548, ack 2080, win 1391, options [nop,nop,TS val 9869210 ecr 9869202], length 372
04:16:49.897077 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2080:2164, ack 2548, win 1396, options [nop,nop,TS val 9869215 ecr 9869210], length 84
04:16:49.937155 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 2164, win 1391, options [nop,nop,TS val 9869255 ecr 9869215], length 0
04:16:53.913025 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2548:2696, ack 2164, win 1391, options [nop,nop,TS val 9873231 ecr 9869215], length 148
04:16:53.949433 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2164:2200, ack 2696, win 1426, options [nop,nop,TS val 9873267 ecr 9873231], length 36
04:16:53.949456 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 2200, win 1391, options [nop,nop,TS val 9873267 ecr 9873267], length 0
04:16:53.949612 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2696:2816, ack 2200, win 1391, options [nop,nop,TS val 9873267 ecr 9873267], length 120
04:16:53.989219 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [.], ack 2816, win 1426, options [nop,nop,TS val 9873307 ecr 9873267], length 0
04:16:54.210424 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2200:2252, ack 2816, win 1426, options [nop,nop,TS val 9873528 ecr 9873267], length 52
04:16:54.212101 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [P.], seq 2816:3276, ack 2252, win 1391, options [nop,nop,TS val 9873530 ecr 9873528], length 460
04:16:54.212113 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [.], ack 3276, win 1457, options [nop,nop,TS val 9873530 ecr 9873530], length 0
04:16:54.221228 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2252:2360, ack 3276, win 1457, options [nop,nop,TS val 9873539 ecr 9873530], length 108
04:16:54.227211 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2360:2460, ack 3276, win 1457, options [nop,nop,TS val 9873545 ecr 9873530], length 100
04:16:54.227280 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 2460, win 1391, options [nop,nop,TS val 9873545 ecr 9873539], length 0
04:16:54.227838 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2460:2496, ack 3276, win 1457, options [nop,nop,TS val 9873545 ecr 9873545], length 36
04:16:54.267040 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 2496, win 1391, options [nop,nop,TS val 9873585 ecr 9873545], length 0
04:16:54.361233 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2496:2564, ack 3276, win 1457, options [nop,nop,TS val 9873679 ecr 9873585], length 68
04:16:54.361251 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 2564, win 1391, options [nop,nop,TS val 9873679 ecr 9873679], length 0
04:16:54.361863 IP 127.0.0.1.22 > 127.0.0.1.42878: Flags [P.], seq 2564:2632, ack 3276, win 1457, options [nop,nop,TS val 9873680 ecr 9873679], length 68
04:16:54.361875 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [.], ack 2632, win 1391, options [nop,nop,TS val 9873680 ecr 9873680], length 0

摘出第三行：

04:16:47.369125 IP 127.0.0.1.42878 > 127.0.0.1.22: Flags [S]【表明是syn建立连接包(即三次握手的第一次握手)】, seq 765824415【seq 序号】, win 43690 【窗口大小】, 
options【TCP首部可选字段】[mss 65495【表示mss是发送端（客户端）通告的最大报文段长度，发送端将不接收超过这个长度的TCP报文段(这个值和MTU有一定关系)】,sackOK【发送端支持并同意使用SACK选项】,TS val 9866687 ecr 0,
nop,wscale 7【nop是一个空操作选项, wscale指出发送端使用的窗口扩大因子为7】], length 0

（3）监听eth0网卡，且通信协议为port22，目标数据来源为192.168.0.100的数据包的命令

tcpdump -i eth0 -nn 'port 22 and src host 192.168.0.100'