Redian新闻
>
CentOS中使用tcpdump抓包

CentOS中使用tcpdump抓包

公众号新闻


安装:

yum install tcpdump

命令使用:

监听特定网卡

tcpdump

抓取第一块网卡所有数据包

[root@server110 tcpdump]# tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:58:14.441562 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 2956277183:2956277391, ack 2178083060, win 336, length 208
15:58:14.442088 IP server110.34562 > ns-px.online.sh.cn.domain: 34223+ PTR? 169.202.16.18.in-addr.arpa. (44)
15:58:14.486822 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 208, win 16419, length 0
15:58:14.692932 IP ns-px.online.sh.cn.domain > server110.34562: 34223 NXDomain 0/1/0 (116)
15:58:14.693416 IP server110.57017 > ns-px.online.sh.cn.domain: 12369+ PTR? 5.209.96.202.in-addr.arpa. (43)
15:58:14.693577 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 208:400, ack 1, win 336, length 192
15:58:14.695254 IP ns-px.online.sh.cn.domain > server110.57017: 12369 1/0/0 PTR ns-px.online.sh.cn. (75)
15:58:14.695519 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 400:656, ack 1, win 336, length 256
15:58:14.696577 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 656:1232, ack 1, win 336, length 576
15:58:14.697564 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 1232:1392, ack 1, win 336, length 160
15:58:14.698563 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 1392:1552, ack 1, win 336, length 160


tcpdump -i 抓取某一块网卡数据包

[root@server110 tcpdump]# ifconfig
eth0 Link encap:Ethernet HWaddr 52:54:00:DE:05:94
inet addr:18.16.200.110 Bcast:18.16.200.255 Mask:255.255.255.0
inet6 addr: fe80::5054:ff:fede:594/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:50017569 errors:0 dropped:0 overruns:0 frame:0
TX packets:27403502 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:21017784488 (19.5 GiB) TX bytes:3969196772 (3.6 GiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:191873 errors:0 dropped:0 overruns:0 frame:0
TX packets:191873 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:31953071 (30.4 MiB) TX bytes:31953071 (30.4 MiB)

[root@server110 tcpdump]# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:59:43.529881 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 2956715807:2956716015, ack 2178087524, win 336, length 208
15:59:43.530636 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 208, win 16422, length 0
15:59:43.530732 IP server110.50508 > ns-px.online.sh.cn.domain: 42810+ PTR? 169.202.16.18.in-addr.arpa. (44)
15:59:43.533748 IP ns-px.online.sh.cn.domain > server110.50508: 42810 NXDomain 0/1/0 (116)
15:59:43.534054 IP server110.37348 > ns-px.online.sh.cn.domain: 43151+ PTR? 5.209.96.202.in-addr.arpa. (43)
15:59:43.534537 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 208:496, ack 1, win 336, length 288
15:59:43.540551 IP ns-px.online.sh.cn.domain > server110.37348: 43151 1/0/0 PTR ns-px.online.sh.cn. (75)
15:59:43.541536 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 496:1072, ack 1, win 336, length 576
15:59:43.542319 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 1072, win 16425, length 0
15:59:43.542529 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 1072:1328, ack 1, win 336, length 256
15:59:43.543545 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 1328:1488, ack 1, win 336, length 160


监听特定主机

[root@server110 tcpdump]# tcpdump  host 18.16.202.169
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:07:16.334596 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 2957160543:2957160751, ack 2178097380, win 336, length 208
16:07:16.375768 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 208, win 16425, length 0
16:07:16.539595 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 208:496, ack 1, win 336, length 288
16:07:16.540553 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 496:656, ack 1, win 336, length 160
16:07:16.541564 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 656:816, ack 1, win 336, length 160
16:07:16.541731 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 656, win 16423, length 0
16:07:16.542572 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 816:1072, ack 1, win 336, length 256
16:07:16.543565 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 1072:1232, ack 1, win 336, length 160


特定来源

[root@server110 tcpdump]# tcpdump src host 18.16.202.169
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:08:30.681395 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 2957168815, win 16420, length 0
16:08:30.791328 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 161, win 16420, length 0
16:08:30.833394 IP 18.16.202.169.cvd > server110.ssh: Flags [.], ack 321, win 16419, length 0


特定目标地址

[root@server110 tcpdump]# tcpdump dst host 18.16.202.169
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:09:27.404603 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 2958878511:2958878719, ack 2178100804, win 336, length 208
16:09:27.408521 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 208:400, ack 1, win 336, length 192
16:09:27.409530 IP server110.ssh > 18.16.202.169.cvd: Flags [P.], seq 400:560, ack 1, win 336, length 160


监听特定端口

[root@server110 tcpdump]# tcpdump port 8083 -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:10:31.361199 IP (tos 0x0, ttl 127, id 19231, offset 0, flags [DF], proto TCP (6), length 52)
18.16.202.169.14626 > server110.us-srv: Flags [S], cksum 0x3315 (correct), seq 2299766793, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:10:31.361264 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
server110.us-srv > 18.16.202.169.14626: Flags [S.], cksum 0x4b86 (correct), seq 1167811532, ack 2299766794, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
16:10:31.361594 IP (tos 0x0, ttl 127, id 19232, offset 0, flags [DF], proto TCP (6), length 40)
18.16.202.169.14626 > server110.us-srv: Flags [.], cksum 0xa54c (correct), seq 1, ack 1, win 8212, length 0


监听tcp协议,并加数据包写入abc.cap

[root@server110 tcpdump]# tcpdump tcp port 8083 -w  ./abc.cap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C15 packets captured
15 packets received by filter
0 packets dropped by kernel


总共15条数据,其中只包含tcp,http格式的数据

稍微复杂例子

tcpdump tcp -i eth1 -t -s 0 -c 100 and dst port ! 22 and src net 192.168.1.0/24 -w ./target.cap


  1. tcp: ip icmp arp rarp 和 tcp、udp、icmp这些选项等都要放到第一个参数的位置,用来过滤数据报的类型

  2. -i eth1 : 只抓经过接口eth1的包

  3. -t : 不显示时间戳

  4. -s 0 : 抓取数据包时默认抓取长度为68字节。加上-S 0 后可以抓到完整的数据包

  5. -c 100 : 只抓取100个数据包

  6. dst port ! 22 : 不抓取目标端口是22的数据包

  7. src net 192.168.1.0/24 : 数据包的源网络地址为192.168.1.0/24

  8. -w ./target.cap : 保存成cap文件,方便用ethereal(即wireshark)分析

链接:https://www.cnblogs.com/hongdada/p/10565898.html

(版权归原作者所有,侵删)

微信扫码关注该文公众号作者

戳这里提交新闻线索和高质量文章给我们。
相关阅读
【七绝】 春柳白鹤 (十四盐) 再和众诗友A Century Later, China’s First Female Architect Gets Her Due物价大对比!美国Costco VS 加拿大Costco:谢谢你,有被安慰到~Costco减肥食品大推荐!28岁男子瘦了整整70磅,全靠Costco【EducationUSA活动】赴美留学两部曲:大学申请与校园生活,7月17日&18日(周三 & 周四),18:30-20:00Costco四月零食大赏!照着买,再也不用羡慕别人家的costco了!来自 Costco 员工的建议:6月在 Costco 看见这些好物必须得买!就这?!“加拿大Costco这么好吃,凭什么我们没有!”美国网友炸了!那要看了中国Costco不得疯了…长篇小说《谷雨立夏间》74 鱼翅+沉香As Summer Begins, Chinese Travel Market Picks Up Momentum双屏 OLED 笔记本 GPD Duo 官宣:10bit 色深、平板模式随意切换Costco 会员优惠只要 $20(原价 $60)!买会员送 Costco Shop Card阿里,鄙视pdd,成为pdd!《星级男人通鉴》第76章 彗星的尾巴Tims出售Popeyes中国业务;Space音乐健身恢复营业;呷哺呷哺创始人回应3年亏8亿... | 刀法品牌热讯5 个常用 tcpdump 抓包命令,值得网工收藏!关注|加拿大5省"沦陷" 齐发警报!Costco中文骗局来了,中使馆警告!有手榴弹,温哥华这儿被大批警方封锁纽约高端楼盘Olympia Dumbo——与明星做邻居Costco买了2年多的旧沙发还能退?一文了解Costco退货政策~Universities Introduce Weight Loss Classes for Unfit Students搞 IT 运维,不仅要懂 Wireshark 抓包,还要会 Tcpdump 抓包Centos7时间同步Chrony(替代ntp软件)“在Costco门口给人画笑脸,时薪30刀”,加拿大“铁饭碗”Costco招聘!自行车赛,欢乐跑,dannish folk pattern精选SDE岗位丨Amazon、Apple、Anduril Industries等公司开放岗位!华府消息|拜登在整个竞选周期中将继续使用TikTok助选精选PM岗位 | DuPont、Koch Industries、Eaton等公司持续热招!来自Costco员工的建议:6月在美国Costco看见这些特价好物,必须得买!Costco承诺:1块5的热狗套餐不涨价!新任CFO给Costco粉丝吃下“定心丸”​好消息!Costco因为通货膨胀稳定部分产品开始降价啦!除了Costco这些商家和产品也跟上了!Vidu直逼Sora,生数科技:还说“中国sora”就太没想象力了【内附Vidu逐帧拆解】非会员不能去Costco美食广场点餐了!Costco再次严查非会员购物明年推出256核3nm CPU!Ampere公布未来路线图,用CPU加速AI计算His Words开源日报 | Grok使用体验完全够不上第一梯队;C++之父反驳白宫观点;Surface Duo在开源社区扶持下焕发新生
logo
联系我们隐私协议©2024 redian.news
Redian新闻
Redian.news刊载任何文章,不代表同意其说法或描述,仅为提供更多信息,也不构成任何建议。文章信息的合法性及真实性由其作者负责,与Redian.news及其运营公司无关。欢迎投稿,如发现稿件侵权,或作者不愿在本网发表文章,请版权拥有者通知本网处理。