執(zhí)行man tcpdump旨椒，顯示結(jié)果如下:
TCPDUMP(1) General Commands Manual TCPDUMP(1)
NAME
tcpdump - dump traffic on a network
SYNOPSIS
tcpdump [ -AbdDefhHIJKlLnNOpqStuUvxX# ] [ -B buffer_size ]
[ -c count ]
[ -C file_size ] [ -G rotate_seconds ] [ -F file ]
[ -i interface ] [ -j tstamp_type ] [ -m module ] [ -M secret ]
[ --number ] [ -Q in|out|inout ]
[ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ]
[ -E spi@ipaddr algo:secret,... ]
[ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
[ --time-stamp-precision=tstamp_precision ]
[ --immediate-mode ] [ --version ]
[ expression ]
其中各個(gè)選項(xiàng)的含義都好理解鉴嗤，最后的 expression該怎么理解呢?
觀察 man tcpdump說(shuō)明航缀，expression的介紹見(jiàn)pcap-filter。
執(zhí)行 man pcap-filter結(jié)果如下：
NAME
pcap-filter - packet filter syntax
DESCRIPTION
pcap_compile() is used to compile a string into a filter program. The resulting filter program can then be applied to some
stream of packets to determine which packets will be supplied to pcap_loop(), pcap_dispatch(), pcap_next(), or
pcap_next_ex().
The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by
one or more qualifiers. There are three different kinds of qualifier:
type type qualifiers say what kind of thing the id name or number refers to. Possible types are host, net , port and por‐
trange. E.g., `host foo', `net 128.3', `port 20', `portrange 6000-6008'. If there is no type qualifier, host is
assumed.
dir dir qualifiers specify a particular transfer direction to and/or from id. Possible directions are src, dst, src or
dst, src and dst, ra, ta, addr1, addr2, addr3, and addr4. E.g., `src foo', `dst net 128.3', `src or dst port ftp-
data'. If there is no dir qualifier, src or dst is assumed. The ra, ta, addr1, addr2, addr3, and addr4 qualifiers
are only valid for IEEE 802.11 Wireless LAN link layers. For some link layers, such as SLIP and the ``cooked'' Linux
capture mode used for the ``any'' device and for some other device types, the inbound and outbound qualifiers can be
used to specify a desired direction.
proto proto qualifiers restrict the match to a particular protocol. Possible protos are: ether, fddi, tr, wlan, ip, ip6,
arp, rarp, decnet, tcp and udp. E.g., `ether src foo', `arp net 128.3', `tcp port 21', `udp portrange 7000-7009',
`wlan addr2 0:2:3:4:5:6'. If there is no proto qualifier, all protocols consistent with the type are assumed. E.g.,
`src foo' means `(ip or arp or rarp) src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp or
rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
綜上可知expresssion中包含3類限定詞导饲，分別是類型捞高，方向，以及協(xié)議渣锦。
類型：包含host硝岗，net， port袋毙， portrange
方向：包含src型檀，dst ，src and dst 听盖， src or dst ....
協(xié)議指：ether ip tcp udp ssh http ...
