TCPDUMP抓包学习
一、抓包基础
1、抓网卡ens33 的包，有多大抓多大，然后保存到a.cap中
[root@localhost ~]# tcpdump -i ens33 -s -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
2、读取a.cap文件
[root@localhost ~]# tcpdump -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::15.381526 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::15.381556 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::16.383090 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::16.383121 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::17.385139 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::17.385273 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::18.385827 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::18.385866 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::19.244187 IP 192.168.10.1. > 239.255.255.250.ssdp: UDP, length
::19.387459 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::19.387517 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.390170 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::20.390271 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.438195 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [P.], seq :, ack , win , length
3、读取详细内容
[root@localhost ~]# tcpdump -A -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
E...] @.@.G...
...
.....e...7q.4P.......u0.L.}H....j.....#|!..v.Y......"<....@.B~..|0.N.n..........,......v........&.(G9.b.a9...f.....Y.t.R....m... .v....B...:.......K....
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
E..(..@...OX..
...
.....7q.4e..$P.............
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
E..<.......H..
...
...F.....abcdefghijklmnopqrstuvwabcdefghi
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
E..<e...@..E..
4、抓tcp 22端口的包
[root@localhost ~]# tcpdump -i ens33 tcp port -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
二、抓包筛选
1、通过操作系统筛选
[root@localhost ~]# tcpdump -r a.cap |awk '{print $3}'|sort -u
reading from file a.cap, link-type EN10MB (Ethernet)
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.cruise-config
192.168.10.1.cruise-swroute
localhost.localdomain.http
2、通过源或目标地址筛选
[root@localhost ~]# tcpdump -n src host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455482 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455616 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455690 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455768 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::01.132478 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.132938 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.134389 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], ack , win , length
::01.136378 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], seq :, ack , win , length : HTTP: HTTP/1.1 Forbidden
::01.136641 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP
::01.163086 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [.], ack , win , length
::01.163388 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.164423 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178354 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178523 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
[root@localhost ~]# tcpdump -n dest host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
tcpdump: syntax error
[root@localhost ~]# tcpdump -n dst host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455392 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455603 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455678 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455757 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::01.132300 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.132607 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.132821 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.133059 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.134332 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET / HTTP/1.1
::01.136670 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.136736 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.162692 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1
::01.163034 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1
::01.178069 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1
::01.178136 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1
::01.372703 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.381626 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
3、筛选端口
[root@localhost ~]# tcpdump -n port -r a.cap
TCPDUMP抓包学习的更多相关文章
- linux下抓包学习--tcpdump的使用
一.为什么需要学这个 很多时候,开发环境上不会出现问题.但在测试或者现场时,总是会有很多莫名其妙的问题. 这时候,能在出问题的环境上,开启抓包,然后再去重现问题的话,这时候,就可以拿到第一手的资料了. ...
- 转：tcpdump抓包分析(强烈推荐)
转自:https://mp.weixin.qq.com/s?__biz=MzAxODI5ODMwOA==&mid=2666539134&idx=1&sn=5166f0aac71 ...
- tcpdump抓包命令
本文转自 : http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html http://www.itshouce.com.cn/l ...
- [转] Android利用tcpdump抓包
原文链接:http://mysuperbaby.iteye.com/blog/902201 Android利用tcpdump抓包 博客分类: Android AndroidAccessGoHTML ...
- TCPdump抓包命令详解--摘
http://blog.csdn.net/s_k_yliu/article/details/6665673/ http://starsliao.blog.163.com/blog/static/890 ...
- Android手机tcpdump抓包
在开发过程中遇到问题时,无法非常方便的获取到数据包,导致分析解决问题比较麻烦.这里介绍如何在Android手机上实现tcpdump抓包. 1.root机器 在用tcpdump抓包过程中,需要使用 ...
- Wireshark和TcpDump抓包分析心得
Wireshark和 TcpDump抓包分析心得 1. Wireshark与tcpdump介绍 Wireshark是一个网络协议检测工具,支持Windows平台和Unix平台,我一般只在Window ...
- tcpdump 抓包让wireshark来分析
在linux下面用tcpdump 抓包非常方便, 但是抓的包要提取出来进行分析, 还是得用wireshark来过滤分析比较方便. 下面先介绍一下 TCPDUMP 的使用 例:tcpdump host ...
- tcpdump抓包并保存成cap文件
首选介绍一下tcpdump的常用参数 tcpdump采用命令行方式,它的命令格式为: tcpdump [ -adeflnNOpqStvx ] [ -c 数量 ] [ -F 文件名 ] [ -i 网络接 ...
随机推荐
- 单例DCL模式
单例模式可以保证系统中一个类只有一个实例.即一个类只有一个对象实例. 一般写法 public class DCLSingle { public static DCLSingle instance= n ...
- MySQL事务和事务隔离级别
1.概述 事务就是对数据库数据进行更改(包括insert.update.delete等)操作的一个执行单元,通常有一条或多条更改语句组成.在同一个事务中的更改操作要么同时成功,要么同时失败. 事务具有 ...
- elasticsearch*3 + Es-Head + kibana Docker集群
ES官方文档:https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html 拉取docker镜像 dock ...
- Java 日期时间与unix时间戳之间转换
日期时间 <--> 时间戳 java.time 包提供的新的日期和时间API LocalDateTime: 本地日期时间类 ZoneId: 时区类 ZonedDateTime: 带时区 ...
- 1+X学习日志——导航栏demo
初级菜鸟的作品,各位大佬见笑了 <!DOCTYPE html> <html lang="en"> <head> <meta c ...
- mysql 插入一个字段 id自增并设置为主键
案例 ALTER TABLE customer MODIFY COLUMN custID int NOT NULL AUTO_INCREMENT 开启: ALTER TABLE 表名 MODIFY C ...
- [AIR] NativeExtension在IOS下的开发实例 --- 新建项目测试ANE(四)
来源:http://bbs.9ria.com/thread-102043-1-1.html 通过前面的努力,好了,我们终于得到了一个ANE文件了.下面我们开始新建一个Flex Mobile项目做一下测 ...
- css设置图片百分比显示，最简洁的代码
css代码: .img-box { padding-bottom: 100%; } .img-box img { position: absolute; top:; bottom:; left:; r ...
- Linux下MySQL的数据文件存放在哪里的？？
http://bbs.csdn.net/topics/390620630 mysql> show variables like '%dir%';+------------------------ ...
- HBase集群环境搭建v1.0
本文档环境基于ubuntu14.04版本,如果最终不使用SuperMap iServer 9D ,可以不配置geomesa-hbase_2.11-2.0.1-bin.tar.gz (转发请注明出处:h ...