1. tcpdump用途
抓包
2. tcpdump用法
tcpdump [option] expression
3. option
-n: 進(jìn)制反向解析，禁用將Ip地址轉(zhuǎn)化為主機(jī)名字
大大縮短命令執(zhí)行時(shí)間
-i: tcpdump抓取的網(wǎng)絡(luò)接口语婴，如果不指定逐抑，tcpdump查找系統(tǒng)接口列表舱卡，監(jiān)聽數(shù)字最小的接口闽颇， 不包含loopback
一般指定any, 可以監(jiān)聽所有的接口
-nn: Don’t convert protocol and port numbers etc. to names either
-s: Snarf snaplen bytes of data from each packet rather than the default of 65535 bytes
抓取整個(gè)包的 snaplen 字節(jié)的數(shù)據(jù)冗酿，而不是默認(rèn)的65535字節(jié)
如果設(shè)置為0券犁，則表面采用默認(rèn)的65535字節(jié)
-Z: Drops privileges (if root) and changes user ID to user and the group ID to the primary group of user
更改用戶id和groupid
-G If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Save files will have the name specified by -w which should include a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous.
如果指定的話术健， 每rotate_seconds秒切換一下dump file
-w Write the raw packets to file rather than parsing and printing them out.
把raw packet寫到文件中，而不是解析打印出來到標(biāo)準(zhǔn)輸出
3. expression
- dst host [parm]
- src host [parm]
- host [parm]
- src port [parm]
- dst port [parm]
- port [parm]
- [proto]
tcp, dup, icmp
4. example
tcpdump -i any -nn port 41001 and host 10.13.32.244 and tcp
tcpdump -iany -nn -Z root -G 10 -w ./%Y_%m_%d-%H_%M_%S.cap tcp and port 41001
