TCPDUMP抓包学习
一、抓包基础
1、抓网卡ens33 的包，有多大抓多大，然后保存到a.cap中
[root@localhost ~]# tcpdump -i ens33 -s -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
2、读取a.cap文件
[root@localhost ~]# tcpdump -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::15.381526 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::15.381556 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::16.383090 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::16.383121 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::17.385139 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::17.385273 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::18.385827 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::18.385866 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::19.244187 IP 192.168.10.1. > 239.255.255.250.ssdp: UDP, length
::19.387459 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::19.387517 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.390170 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::20.390271 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.438195 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [P.], seq :, ack , win , length
3、读取详细内容
[root@localhost ~]# tcpdump -A -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
E...] @.@.G...
...
.....e...7q.4P.......u0.L.}H....j.....#|!..v.Y......"<....@.B~..|0.N.n..........,......v........&.(G9.b.a9...f.....Y.t.R....m... .v....B...:.......K....
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
E..(..@...OX..
...
.....7q.4e..$P.............
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
E..<.......H..
...
...F.....abcdefghijklmnopqrstuvwabcdefghi
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
E..<e...@..E..
4、抓tcp 22端口的包
[root@localhost ~]# tcpdump -i ens33 tcp port -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
二、抓包筛选
1、通过操作系统筛选
[root@localhost ~]# tcpdump -r a.cap |awk '{print $3}'|sort -u
reading from file a.cap, link-type EN10MB (Ethernet)
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.cruise-config
192.168.10.1.cruise-swroute
localhost.localdomain.http
2、通过源或目标地址筛选
[root@localhost ~]# tcpdump -n src host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455482 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455616 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455690 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455768 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::01.132478 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.132938 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.134389 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], ack , win , length
::01.136378 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], seq :, ack , win , length : HTTP: HTTP/1.1 Forbidden
::01.136641 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP
::01.163086 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [.], ack , win , length
::01.163388 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.164423 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178354 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178523 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
[root@localhost ~]# tcpdump -n dest host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
tcpdump: syntax error
[root@localhost ~]# tcpdump -n dst host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455392 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455603 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455678 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455757 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::01.132300 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.132607 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.132821 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.133059 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.134332 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET / HTTP/1.1
::01.136670 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.136736 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.162692 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1
::01.163034 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1
::01.178069 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1
::01.178136 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1
::01.372703 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.381626 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
3、筛选端口
[root@localhost ~]# tcpdump -n port -r a.cap
TCPDUMP抓包学习的更多相关文章
- linux下抓包学习--tcpdump的使用
一.为什么需要学这个 很多时候,开发环境上不会出现问题.但在测试或者现场时,总是会有很多莫名其妙的问题. 这时候,能在出问题的环境上,开启抓包,然后再去重现问题的话,这时候,就可以拿到第一手的资料了. ...
- 转：tcpdump抓包分析(强烈推荐)
转自:https://mp.weixin.qq.com/s?__biz=MzAxODI5ODMwOA==&mid=2666539134&idx=1&sn=5166f0aac71 ...
- tcpdump抓包命令
本文转自 : http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html http://www.itshouce.com.cn/l ...
- [转] Android利用tcpdump抓包
原文链接:http://mysuperbaby.iteye.com/blog/902201 Android利用tcpdump抓包 博客分类: Android AndroidAccessGoHTML ...
- TCPdump抓包命令详解--摘
http://blog.csdn.net/s_k_yliu/article/details/6665673/ http://starsliao.blog.163.com/blog/static/890 ...
- Android手机tcpdump抓包
在开发过程中遇到问题时,无法非常方便的获取到数据包,导致分析解决问题比较麻烦.这里介绍如何在Android手机上实现tcpdump抓包. 1.root机器 在用tcpdump抓包过程中,需要使用 ...
- Wireshark和TcpDump抓包分析心得
Wireshark和 TcpDump抓包分析心得 1. Wireshark与tcpdump介绍 Wireshark是一个网络协议检测工具,支持Windows平台和Unix平台,我一般只在Window ...
- tcpdump 抓包让wireshark来分析
在linux下面用tcpdump 抓包非常方便, 但是抓的包要提取出来进行分析, 还是得用wireshark来过滤分析比较方便. 下面先介绍一下 TCPDUMP 的使用 例:tcpdump host ...
- tcpdump抓包并保存成cap文件
首选介绍一下tcpdump的常用参数 tcpdump采用命令行方式,它的命令格式为: tcpdump [ -adeflnNOpqStvx ] [ -c 数量 ] [ -F 文件名 ] [ -i 网络接 ...
随机推荐
- Java -- 最简单的认识重载
定义 方法的名称相同,参数个数或类型不同的时候就成为方法重载. 示例 编写一个两个数相加的方法: public class hello{ public static void main(String ...
- [NOI2008]志愿者招募 (费用流)
大意: $n$天, 第$i$天要$a_i$个志愿者. $m$种志愿者, 每种无限多, 第$i$种工作时间$[s_i,t_i]$花费$c_i$, 求最少花费. 源点$S$连第一天, 容量$INF$ 第$ ...
- 2 Match、Filter、排序、分页、全文检索、短语匹配、关键词高亮
查索引内所有文档记录 GET /beauties/my/_search GET /beauties/my/_search { "query":{ & ...
- Spring Boot + RabbitMQ 配置参数解释
最近生产RabbitMQ出了几次问题,所以抽时间整理了一份关于Spring Boot 整合RabbitMQ环境下的配置参数解释,通过官网文档和网上其他朋友一些文章参考归纳整理而得,有错误之处还请指正~ ...
- JavaScript常见的输出方式
1.通过弹窗的形式来输出 alert(需要输出的内容); alert("hello world"); confirm(需要输出的内容); prompt("请输入内容:&q ...
- Java Runtime.exec()用法
转自:https://www.cnblogs.com/mingforyou/p/3551199.html Java Runtime.exec()的使用 Sun的doc里其实说明还有其他的用法: exe ...
- 从零开始学虚拟DOM
此文主要翻译自:Building a Simple Virtual DOM from Scratch,看原文的同学请直达! 此文是作者在一次现场编程演讲时现场所做的,有关演讲的相关资料我们也可以在原英 ...
- redis 异常 MISCONF Redis is configured to save RDB snapshots, but is currently not able to persist on disk
MISCONF Redis is configured to save RDB snapshots, but is currently not able to persist on disk. 解决方 ...
- 0001-代码仓库-mvn
暂缺 基本介绍 web管理 ifsvnadmin
- 微信小程序分享小程序码的生成，多参数以及参数的获取
如果本文对你有用,请爱心点个赞,提高排名,帮助更多的人.谢谢大家!❤ 如果解决不了,可以在文末进群交流. 官方文档地址:https://developers.weixin.qq.com/minipro ...