netcat — a utility that is able to write and read data across TCP and UDP network connections.

• -v: produce more verbose(冗余的) output
• -w timeout: connections which cannot be established or are idle timeout after timeout second.
• -z: only scan for listening daemon, without sending any data to them.
• -n: do not do any DNS or service lookups on any address, hostname or ports.
• -l: listen for an incoming connection rather than initiating a connection to a remote host.
• -k: when a connection is completed, listen for another one.
• -p source_port: specify the source port nc should use.
• -u: use UDP instead of TCP.

(1) nc -v -w 2 -z target 22-23: try connecting to every port in [22, 23] at the target

ports scanning

grab port banners

// server
nc -l -p 1234 > filename.txt

// client
nc destination 1234 < filename.txt

wc — print new line, word and byte counts for each file

• -l: print the new line counts.
• -w: print the word counts.
• -m: print the character counts.
• -c: print the byte counts.

(1) wc file: print number of lines, number of words, number of bytes, filename for file

wc co_routine.cpp

count file number

tcpdump — dump traffic on a network

• -A: print each packet (minus its link level header) in ASCII.
• -X: print each packet (minus its link level header) in hex and ASCII.
• -i interface: select interface that the capture is to take place on.
• -n: don’t convert host addresses to names.
• -nn: don’t convert protocol and port numbers etc. to names either.
• -s snaplen: snarf snaplen bytes of data from each packet rather than the default of 65535 bytes.
• -S: Print absolute, rather than relative, TCP sequence numbers.
• -v, -vv, -vvv: show more protocol specific information.

pcap-filter — packet filter syntax

• port port: either the source or destination port of the packet is port.
• host host: either the source or destination of the packet is host.
• src host host/src port port: the source of the packet is host/port.
• dst host host/dst port port: the destination of the packet is host/port.

(1) tcpdump -nn -vv port 80: capture traffic on port 80

Flags are some combination of S(SYN), F(FIN), P(PUSH), R(RST), W(ECN CWR) or E (ECN-Echo), or a single ‘.’ (no flags).

capture port 80

tcpdump ASCII

capture on destination port

ss -- used to dump socket statistics

• no option: displays a list of open non-listening sockets(e.g. TCP/UNIX/UDP) that have established connection.
• -t: Display TCP sockets.
• -u: Display UDP sockets.
• -x: Display Unix domain sockets.
• -a: Display both listening and non-listening (for TCP this means established connections) sockets.
• -n: Do not try to resolve service names.
• -l: Display only listening sockets (these are omitted by default).
• -p: Show the process name/pid which owns the connection.
• -s: Print summary statistics.
• -4: Display only IP version 4 sockets
• -6: Display only IP version 6 sockets
• [ state TCP-STATE ] [ EXPRESSION ]: Filtering connections by tcp state or EXPRESSION

STATE-FILTER allows to construct arbitrary set of states to match. Its syntax is sequence of keywords state and exclude followed by identifier of state.
Available identifiers are:

• all standard TCP states: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening and closing.
• all - for all the states
• connected - all the states except for listening and closed
• synchronized - all the connected states except for syn-sent
• bucket - states, which are maintained as minisockets, i.e. time-wait and syn-recv
• big - opposite to bucket

(1) ss -tu: filter out tcp and udp connections

ubuntu@VM-100-62-ubuntu:~$ ss -tu
Netid     State       Recv-Q       Send-Q              Local Address:Port                Peer Address:Port       
tcp       ESTAB       0            0                   10.xxx.100.xx:ssh                61.xxx.169.xx:30199      
tcp       ESTAB       0            0                   10.xxx.100.xx:42710             10.xxx.231.xxx:5574