TCPDUMP抓包学习
一、抓包基础
1、抓网卡ens33 的包，有多大抓多大，然后保存到a.cap中
[root@localhost ~]# tcpdump -i ens33 -s -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
2、读取a.cap文件
[root@localhost ~]# tcpdump -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::15.381526 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::15.381556 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::16.383090 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::16.383121 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::17.385139 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::17.385273 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::18.385827 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::18.385866 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::19.244187 IP 192.168.10.1. > 239.255.255.250.ssdp: UDP, length
::19.387459 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::19.387517 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.390170 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::20.390271 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.438195 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [P.], seq :, ack , win , length
3、读取详细内容
[root@localhost ~]# tcpdump -A -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
E...] @.@.G...
...
.....e...7q.4P.......u0.L.}H....j.....#|!..v.Y......"<....@.B~..|0.N.n..........,......v........&.(G9.b.a9...f.....Y.t.R....m... .v....B...:.......K....
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
E..(..@...OX..
...
.....7q.4e..$P.............
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
E..<.......H..
...
...F.....abcdefghijklmnopqrstuvwabcdefghi
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
E..<e...@..E..
4、抓tcp 22端口的包
[root@localhost ~]# tcpdump -i ens33 tcp port -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
二、抓包筛选
1、通过操作系统筛选
[root@localhost ~]# tcpdump -r a.cap |awk '{print $3}'|sort -u
reading from file a.cap, link-type EN10MB (Ethernet)
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.cruise-config
192.168.10.1.cruise-swroute
localhost.localdomain.http
2、通过源或目标地址筛选
[root@localhost ~]# tcpdump -n src host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455482 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455616 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455690 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455768 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::01.132478 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.132938 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.134389 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], ack , win , length
::01.136378 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], seq :, ack , win , length : HTTP: HTTP/1.1 Forbidden
::01.136641 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP
::01.163086 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [.], ack , win , length
::01.163388 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.164423 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178354 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178523 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
[root@localhost ~]# tcpdump -n dest host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
tcpdump: syntax error
[root@localhost ~]# tcpdump -n dst host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455392 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455603 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455678 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455757 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::01.132300 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.132607 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.132821 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.133059 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.134332 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET / HTTP/1.1
::01.136670 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.136736 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.162692 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1
::01.163034 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1
::01.178069 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1
::01.178136 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1
::01.372703 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.381626 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
3、筛选端口
[root@localhost ~]# tcpdump -n port -r a.cap
TCPDUMP抓包学习的更多相关文章
- linux下抓包学习--tcpdump的使用
一.为什么需要学这个 很多时候,开发环境上不会出现问题.但在测试或者现场时,总是会有很多莫名其妙的问题. 这时候,能在出问题的环境上,开启抓包,然后再去重现问题的话,这时候,就可以拿到第一手的资料了. ...
- 转：tcpdump抓包分析(强烈推荐)
转自:https://mp.weixin.qq.com/s?__biz=MzAxODI5ODMwOA==&mid=2666539134&idx=1&sn=5166f0aac71 ...
- tcpdump抓包命令
本文转自 : http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html http://www.itshouce.com.cn/l ...
- [转] Android利用tcpdump抓包
原文链接:http://mysuperbaby.iteye.com/blog/902201 Android利用tcpdump抓包 博客分类: Android AndroidAccessGoHTML ...
- TCPdump抓包命令详解--摘
http://blog.csdn.net/s_k_yliu/article/details/6665673/ http://starsliao.blog.163.com/blog/static/890 ...
- Android手机tcpdump抓包
在开发过程中遇到问题时,无法非常方便的获取到数据包,导致分析解决问题比较麻烦.这里介绍如何在Android手机上实现tcpdump抓包. 1.root机器 在用tcpdump抓包过程中,需要使用 ...
- Wireshark和TcpDump抓包分析心得
Wireshark和 TcpDump抓包分析心得 1. Wireshark与tcpdump介绍 Wireshark是一个网络协议检测工具,支持Windows平台和Unix平台,我一般只在Window ...
- tcpdump 抓包让wireshark来分析
在linux下面用tcpdump 抓包非常方便, 但是抓的包要提取出来进行分析, 还是得用wireshark来过滤分析比较方便. 下面先介绍一下 TCPDUMP 的使用 例:tcpdump host ...
- tcpdump抓包并保存成cap文件
首选介绍一下tcpdump的常用参数 tcpdump采用命令行方式,它的命令格式为: tcpdump [ -adeflnNOpqStvx ] [ -c 数量 ] [ -F 文件名 ] [ -i 网络接 ...
随机推荐
- Pandas的基础操作（一）——矩阵表的创建及其属性
Pandas的基础操作(一)——矩阵表的创建及其属性 (注:记得在文件开头导入import numpy as np以及import pandas as pd) import pandas as pd ...
- INNODB 统计信息采集
SHOW GLOBAL VARIABLES LIKE 'INNODB_STATS_PERSISTENT_SAMPLE_PAGES'; ALTER TABLE TABLE_NAME STATS_SAMP ...
- 作为一个纯粹数据结构的 Redis Streams
来源:antirez 翻译:Kevin (公众号:中间件小哥) Redis 5 中引入了一个名为 Streams 的新的 Redis 数据结构,吸引了社区极大的兴趣.接下来,我会在社区里进行调查,同用 ...
- Windows MySql增量备份、完整备份采坑之路
1.前言 这周公司交给我一个任务,负责项目Mysql数据库的备份,因为项目上线后数据是一个大问题,出了什么问题数据才是最大的问题,备份这时候就显得尤为重要, 公司项目的思路是:在项目系统设置内可以勾选 ...
- JavaJDK多任务执行框架（六）
class Temp extends Thread { public void run() { System.out.println("run"); } } public clas ...
- (五) Docker 安装 Nginx
参考并感谢 官方文档 https://hub.docker.com/_/nginx 下载nginx镜像(不带tag标签则表示下载latest版本) docker pull nginx 启动 nginx ...
- ABAP开发环境终于支持以驼峰命名法自动格式化ABAP变量名了
Jerry进入SAP成都研究院前,一直是用C/C++开发,所以刚接触ABAP,对于她在某些语法环境下大小写敏感,某些环境下不敏感的特性很不适应.那时候Jerry深深地怀念之前在C/C++编程时遵循的驼 ...
- Python学习资料收集
1.Learn Python the hard way 2.Google's Python lesson 3.Python最佳实践 4.Full Stack Python 5.explore flas ...
- sqlserver 汉字转拼音（转载）
转载来源一:https://www.cnblogs.com/zhuisuo/archive/2012/01/11/2318908.html 汉字转全拼音函数优化方案(SQLServer),值得你看看 ...
- 逗号分隔的字符串转成表格参与IN条件查询
返回值为'1,2,3,4,5,6,7',是一个字符串,如果要用IN 查询的话sql认为这是一个完整的字符串,需要将内容分隔转换变成table 定义函数如下: create Function sysfS ...