TCPDUMP

Author: Xu FC

TCPDUMP 參數(shù)

-c <number>: 指定抓包個數(shù)

tcpdump -c 2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
05:55:13.756478 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2630991455:2630991651, ack 3844704184, win 255, length 196
05:55:13.757398 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 196:376, ack 1, win 255, length 180
2 packets captured
2 packets received by filter
0 packets dropped by kernel

-i <interface>: 指定目標(biāo)端口

tcpdump -i eth0 -c 1
05:28:56.313349 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 645536:645700, ack 365, win 255, length 164
1 packets captured
1 packets received by filter
0 packets dropped by kernel

-q: 打印少量協(xié)議相關(guān)內(nèi)容

tcpdump -i any -q -c 1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
05:56:23.517366 IP 193.1.3.11.ssh > 193.1.3.2.51871: tcp 196
1 packet captured
17 packets received by filter
0 packets dropped by kernel

-v: 顯示詳細(xì)內(nèi)容, -vv, -vvv

tcpdump -i any -c 1 -vvv
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
05:57:29.524244 IP (tos 0x10, ttl 64, id 57549, offset 0, flags [DF], proto TCP (6), length 172)
    193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], cksum 0x88ae (incorrect -> 0x2d8b), seq 2630995235:2630995367, ack 3844705656, win 255, length 132
1 packet captured
18 packets received by filter
0 packets dropped by kernel

-w <file_name>: 將抓包結(jié)果保存到文件中

tcpdump -i any -c 1 -w file.cap
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
1 packet captured
1 packet received by filter
0 packets dropped by kernel

-r <file_name>: 從文件中讀取數(shù)據(jù)

tcpdump -r file.cap 
reading from file file.cap, link-type LINUX_SLL (Linux cooked)
05:58:16.533695 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2630996863:2630996995, ack 3844706644, win 255, length 132

基于協(xié)議過濾

arp: 過濾 ARP

tcpdump  -c 2 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:24:22.276090 ARP, Request who-has 193.1.2.52 tell 193.1.2.141, length 46
01:24:22.276140 ARP, Request who-has 193.1.2.62 tell 193.1.2.141, length 46
2 packets captured
2 packets received by filter
0 packets dropped by kernel

icmp,tcp, udp...

tcpdump  -c 1 tcp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:25:44.395200 IP 193.1.1.231.ssh > 193.1.1.110.52972: Flags [P.], seq 2915666324:2915666440, ack 3897014413, win 264, length 116
1 packet captured
7 packets received by filter
0 packets dropped by kernel

基于 IP 地址的過濾

host <IP address>: 過濾源 IP 或者目的 IP 為指定 IP 地址的包

tcpdump -c 1 host 193.1.3.11 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:01:59.130264 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631002191:2631002387, ack 3844711220, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

src/dst <IP address>: 過濾源/目的 IP

tcpdump -c 1 src 193.1.3.11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:06:12.125502 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631002819:2631003015, ack 3844711340, win 255, length 196
1 packet captured
3 packets received by filter
0 packets dropped by kernel

net <sub net>: 過濾源 IP 或者目的 IP 在指定子網(wǎng)的包

tcpdump -c 1 net 193.1.3.0/24
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:09:01.518140 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631005067:2631005263, ack 3844712968, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

src/dst net <sub net>: 過濾源/目的 IP 地址在指定子網(wǎng)范圍的包

tcpdump -c 1 src net 193.1.3.0/24
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:10:27.133894 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631005711:2631005907, ack 3844713104, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

基于 port 過濾

port <port>: 過濾源 port 或者目的 port 為指定 port 的包

tcpdump -c 1 port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:12:44.258223 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631006339:2631006535, ack 3844713224, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

src/dst port: 過濾源/目的 port

tcpdump -c 1 src net 193.1.3.0/24 and not src port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:13:44.650217 IP 193.1.3.2.51871 > 193.1.3.11.ssh: Flags [.], ack 2631007195, win 16321, length 0
1 packet captured
1 packet received by filter
0 packets dropped by kernel

基于 TCP flag 過濾

tcp[13] & 2!=0: 過濾 SYN

tcpdump  -c 2 net 193.0.0.0/8 and "tcp[13] & 2 != 0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:22:49.679842 IP 193.1.1.110.53106 > 193.1.1.231.ssh: Flags [S], seq 423562932, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
01:22:49.679922 IP 193.1.1.231.ssh > 193.1.1.110.53106: Flags [S.], seq 1364181361, ack 423562933, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
2 packets captured
2 packets received by filter
0 packets dropped by kernel

tcp[13] & 16 !=0: 過濾 ACK

tcpdump  -c 2 net 193.0.0.0/8 and "tcp[13] & 16!=0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:27:47.239368 IP 193.1.1.231.ssh > 193.1.1.110.52972: Flags [P.], seq 2915667924:2915668120, ack 3897015017, win 264, length 196
01:27:47.245847 IP 193.1.1.231.ssh > 193.1.1.110.52972: Flags [P.], seq 196:376, ack 1, win 264, length 180
2 packets captured
2 packets received by filter
0 packets dropped by kernel

tcp[13]=18: 過濾 SYN ACK

tcpdump net 193.0.0.0/8 and "tcp[13]=18"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:30:13.419672 IP 193.1.1.231.ssh > 193.1.1.110.53677: Flags [S.], seq 1820623300, ack 1594275082, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel

tcp[13] & 4!=0: 過濾 RST

tcpdump "tcp[13] & 4!=0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:31:43.821051 IP 193.1.1.231.microsoft-ds > 193.1.1.62.56513: Flags [R.], seq 0, ack 3270176790, win 0, length 0

tcp[13] & 1!=0: 過濾 FIN

tcpdump "tcp[13] & 1!=0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:33:36.082121 IP 193.1.1.231.ssh > 193.1.1.110.53939: Flags [F.], seq 3223250025, ack 2445636549, win 246, length 0
01:33:36.082691 IP 193.1.1.110.53939 > 193.1.1.231.ssh: Flags [F.], seq 1, ack 1, win 16412, length 0

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者

人面猴
序言：七十年代末掉盅，一起剝皮案震驚了整個濱河市铃剔，隨后出現(xiàn)的幾起案子，更是在濱河造成了極大的恐慌，老刑警劉巖键俱，帶你破解...
沈念sama閱讀 219,039評論 6贊 508
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件，死亡現(xiàn)場離奇詭異，居然都是意外死亡，警方通過查閱死者的電腦和手機(jī)板惑，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 93,426評論 3贊 395
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門，熙熙樓的掌柜王于貴愁眉苦臉地迎上來偎快，“玉大人冯乘，你說我怎么就攤上這事∩辜校” “怎么了裆馒？”我有些...
開封第一講書人閱讀 165,417評論 0贊 356
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵，是天一觀的道長惋戏。經(jīng)常有香客問我领追，道長，這世上最難降的妖魔是什么响逢？我笑而不...
開封第一講書人閱讀 58,868評論 1贊 295
?港島之戀（遺憾婚禮）
正文為了忘掉前任绒窑，我火速辦了婚禮，結(jié)果婚禮上舔亭，老公的妹妹穿的比我還像新娘些膨。我一直安慰自己，他們只是感情好钦铺，可當(dāng)我...
茶點(diǎn)故事閱讀 67,892評論 6贊 392
惡毒庶女頂嫁案：這布局不是一般人想出來的
文/花漫我一把揭開白布订雾。她就那樣靜靜地躺著，像睡著了一般矛洞。火紅的嫁衣襯著肌膚如雪洼哎。梳的紋絲不亂的頭發(fā)上，一...
開封第一講書人閱讀 51,692評論 1贊 305
城市分裂傳說
那天沼本，我揣著相機(jī)與錄音噩峦，去河邊找鬼。笑死抽兆，一個胖子當(dāng)著我的面吹牛识补，可吹牛的內(nèi)容都是我干的。我是一名探鬼主播辫红，決...
沈念sama閱讀 40,416評論 3贊 419
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼凭涂，長吁一口氣：“原來是場噩夢啊……” “哼！你這毒婦竟也來了贴妻？” 一聲冷哼從身側(cè)響起切油，我...
開封第一講書人閱讀 39,326評論 0贊 276
萬榮殺人案實(shí)錄
序言：老撾萬榮一對情侶失蹤，失蹤者是張志新（化名）和其女友劉穎名惩，沒想到半個月后白翻，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
沈念sama閱讀 45,782評論 1贊 316
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 37,957評論 3贊 337
?白月光啟示錄
正文我和宋清朗相戀三年滤馍，在試婚紗的時候發(fā)現(xiàn)自己被綠了岛琼。大學(xué)時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
茶點(diǎn)故事閱讀 40,102評論 1贊 350
活死人
序言：一個原本活蹦亂跳的男人離奇死亡巢株，死狀恐怖槐瑞，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情阁苞，我是刑警寧澤困檩，帶...
沈念sama閱讀 35,790評論 5贊 346
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布，位于F島的核電站那槽，受9級特大地震影響悼沿，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜骚灸，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 41,442評論 3贊 331
男人毒藥：我在死后第九天來索命
文/蒙蒙一糟趾、第九天我趴在偏房一處隱蔽的房頂上張望。院中可真熱鬧甚牲，春花似錦义郑、人聲如沸。這莊子的主人今日做“春日...
開封第一講書人閱讀 31,996評論 0贊 22
一樁弒父案非驮，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽。三九已至雏赦，卻和暖如春劫笙，著一層夾襖步出監(jiān)牢的瞬間，已是汗流浹背星岗。一陣腳步聲響...
開封第一講書人閱讀 33,113評論 1贊 272
情欲美人皮
我被黑心中介騙來泰國打工填大，沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留，地道東北人伍茄。一個月前我還...
沈念sama閱讀 48,332評論 3贊 373
代替公主和親
正文我出身青樓栋盹，卻偏偏與公主長得像施逾，于是被迫代替她去往敵國和親敷矫。傳聞我的和親對象是個殘疾皇子，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 45,044評論 2贊 355

TCPDUMP

TCPDUMP 參數(shù)

基于協(xié)議過濾

基于 IP 地址的過濾

基于 port 過濾

基于 TCP flag 過濾

推薦閱讀更多精彩內(nèi)容