学点TCPDUMP

[root@future ~]# yum install tcpdump

官网地址：

https://nmap.org/

还有中文手册，太感动了

https://nmap.org/man/zh/man-port-scanning-basics.html

1.直接输入tcpdump

输出大量信息，按ctrl+c终止，每一行都是一个数据包

 packets captured
 packets received by filter
 packets dropped by kernel

2.只抓去10个包

[root@future ~]# tcpdump -c
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size  bytes
::40.818075 IP 192.168.247.130.ssh > 192.168.247.1.: Flags [P.], seq :, ack , win , length
::40.818885 IP 192.168.247.130. > 192.168.247.2.domain: + PTR? 1.247.168.192.in-addr.arpa. ()
::40.855105 ARP, Request who-has 192.168.247.130 tell 192.168.247.2, length
::40.855120 ARP, Reply 192.168.247.130 is-at :0c:::1d: (oui Unknown), length
::40.855187 IP 192.168.247.2.domain > 192.168.247.130.:  NXDomain // ()
::40.855426 IP 192.168.247.130. > 192.168.247.2.domain: + PTR? 130.247.168.192.in-addr.arpa. ()
::40.877511 IP 192.168.247.1. > 192.168.247.130.ssh: Flags [.], ack , win , length
::40.888226 IP 192.168.247.2.domain > 192.168.247.130.:  NXDomain // ()
::40.888506 IP 192.168.247.130. > 192.168.247.2.domain: + PTR? 2.247.168.192.in-addr.arpa. ()
::40.896265 IP 192.168.247.130.ssh > 192.168.247.1.: Flags [P.], seq :, ack , win , length
 packets captured
 packets received by filter
 packets dropped by kernel

抓去的包默认不回保存，我们可以加-w参数保存

[root@future ~]# tcpdump -c  -w dumps.log
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size  bytes
 packets captured
 packets received by filter
 packets dropped by kernel

保存下来的数据不能直接查看，使用-r参数

[root@future ~]# tcpdump -r dumps.log 

3.显示系统有那些网络设备

[root@future ~]# tcpdump -D
.eth0
.nflog (Linux netfilter log (NFLOG) interface)
.nfqueue (Linux netfilter queue (NFQUEUE) interface)
.usbmon1 (USB bus number )
.usbmon2 (USB bus number )
.any (Pseudo-device that captures on all interfaces)
.lo

4.指定网卡监听

[root@future ~]# tcpdump -i eth0

5.显示更为详细的信息，比如分片

[root@future ~]# tcpdump -v
或者
[root@future ~]# tcpdump -vv

6.不要将IP地址反解为主机名

[root@future ~]# tcpdump -n

7.只抓去udp包

[root@future ~]# tcpdump udp

8.只抓取ICMP包

[root@future ~]# tcpdump icmp

9.只抓取某个具体端口流量

[root@future ~]# tcpdump port 

10.指定端口范围

[root@future ~]# tcpdump portrange -

11.指定源端口或者目标端口
源端口：

[root@future ~]# tcpdump src port 

目标端口：

[root@future ~]# tcpdump dst port 

12.抓去包含指定主机名的流量包

[root@future ~]# tcpdump host www.baidu.com

13.抓去大于1000子节的流量

[root@future ~]# tcpdump greater 

小于1000字节的流量包

[root@future ~]# tcpdump less 

14.查看数据包内容

[root@future ~]# tcpdump -A

以ASCII码形式显示，内容不一定可以查看。

15.两种形式查看数据包内容

[root@future ~]# tcpdump -X

二进制和ASCII显示

16.抓去来自某个IP的数据包

[root@future ~]# tcpdump src 192.168.247.1

抓取目标是某个IP的数据包

[root@future ~]# tcpdump dst 192.168.247.1

17.使用逻辑关键字

[root@future ~]# tcpdump tcp and src 192.168.247.1

[root@future ~]# tcpdump tcp and src 192.168.247.1 and port 

[root@future ~]# tcpdump src 192.168.247.1 or  src 192.168.247.2

[root@future ~]# tcpdump not port 

[root@future ~]# tcpdump tcp and src 192.168.247.1 and not port 80