TCPDUMP抓包学习
一、抓包基础
1、抓网卡ens33 的包，有多大抓多大，然后保存到a.cap中
[root@localhost ~]# tcpdump -i ens33 -s -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
2、读取a.cap文件
[root@localhost ~]# tcpdump -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::15.381526 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::15.381556 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::16.383090 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::16.383121 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::17.385139 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::17.385273 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::18.385827 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::18.385866 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::19.244187 IP 192.168.10.1. > 239.255.255.250.ssdp: UDP, length
::19.387459 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::19.387517 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.390170 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::20.390271 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.438195 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [P.], seq :, ack , win , length
3、读取详细内容
[root@localhost ~]# tcpdump -A -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
E...] @.@.G...
...
.....e...7q.4P.......u0.L.}H....j.....#|!..v.Y......"<....@.B~..|0.N.n..........,......v........&.(G9.b.a9...f.....Y.t.R....m... .v....B...:.......K....
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
E..(..@...OX..
...
.....7q.4e..$P.............
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
E..<.......H..
...
...F.....abcdefghijklmnopqrstuvwabcdefghi
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
E..<e...@..E..
4、抓tcp 22端口的包
[root@localhost ~]# tcpdump -i ens33 tcp port -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
二、抓包筛选
1、通过操作系统筛选
[root@localhost ~]# tcpdump -r a.cap |awk '{print $3}'|sort -u
reading from file a.cap, link-type EN10MB (Ethernet)
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.cruise-config
192.168.10.1.cruise-swroute
localhost.localdomain.http
2、通过源或目标地址筛选
[root@localhost ~]# tcpdump -n src host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455482 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455616 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455690 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455768 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::01.132478 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.132938 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.134389 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], ack , win , length
::01.136378 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], seq :, ack , win , length : HTTP: HTTP/1.1 Forbidden
::01.136641 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP
::01.163086 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [.], ack , win , length
::01.163388 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.164423 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178354 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178523 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
[root@localhost ~]# tcpdump -n dest host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
tcpdump: syntax error
[root@localhost ~]# tcpdump -n dst host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455392 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455603 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455678 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455757 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::01.132300 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.132607 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.132821 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.133059 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.134332 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET / HTTP/1.1
::01.136670 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.136736 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.162692 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1
::01.163034 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1
::01.178069 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1
::01.178136 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1
::01.372703 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.381626 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
3、筛选端口
[root@localhost ~]# tcpdump -n port -r a.cap
TCPDUMP抓包学习的更多相关文章
- linux下抓包学习--tcpdump的使用
一.为什么需要学这个 很多时候,开发环境上不会出现问题.但在测试或者现场时,总是会有很多莫名其妙的问题. 这时候,能在出问题的环境上,开启抓包,然后再去重现问题的话,这时候,就可以拿到第一手的资料了. ...
- 转：tcpdump抓包分析(强烈推荐)
转自:https://mp.weixin.qq.com/s?__biz=MzAxODI5ODMwOA==&mid=2666539134&idx=1&sn=5166f0aac71 ...
- tcpdump抓包命令
本文转自 : http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html http://www.itshouce.com.cn/l ...
- [转] Android利用tcpdump抓包
原文链接:http://mysuperbaby.iteye.com/blog/902201 Android利用tcpdump抓包 博客分类: Android AndroidAccessGoHTML ...
- TCPdump抓包命令详解--摘
http://blog.csdn.net/s_k_yliu/article/details/6665673/ http://starsliao.blog.163.com/blog/static/890 ...
- Android手机tcpdump抓包
在开发过程中遇到问题时,无法非常方便的获取到数据包,导致分析解决问题比较麻烦.这里介绍如何在Android手机上实现tcpdump抓包. 1.root机器 在用tcpdump抓包过程中,需要使用 ...
- Wireshark和TcpDump抓包分析心得
Wireshark和 TcpDump抓包分析心得 1. Wireshark与tcpdump介绍 Wireshark是一个网络协议检测工具,支持Windows平台和Unix平台,我一般只在Window ...
- tcpdump 抓包让wireshark来分析
在linux下面用tcpdump 抓包非常方便, 但是抓的包要提取出来进行分析, 还是得用wireshark来过滤分析比较方便. 下面先介绍一下 TCPDUMP 的使用 例:tcpdump host ...
- tcpdump抓包并保存成cap文件
首选介绍一下tcpdump的常用参数 tcpdump采用命令行方式,它的命令格式为: tcpdump [ -adeflnNOpqStvx ] [ -c 数量 ] [ -F 文件名 ] [ -i 网络接 ...
随机推荐
- pandas中的axis参数（看其他人的博客中产生的疑问点，用自己的话解析出来）
axis有两个值:axis=0或者axis=1 看到很多资料都不太理解,把我个人理解说一下: 下面这张图,在很多资料中都看到了,我只能说先死记住 axis=0,代表跨行(注意看这张图的axis=0的箭 ...
- PAT(B) 1050 螺旋矩阵（Java：24分）
题目链接:1050 螺旋矩阵 (25 point(s)) 题目描述 本题要求将给定的 N 个正整数按非递增的顺序,填入"螺旋矩阵".所谓"螺旋矩阵",是指从左上 ...
- JVM运行参数优化详细教程
获取设置的参数str的值: 常用的-X参数有以下这些: 手动调用GC执行垃圾回收操作:(-XX:+DisableExplicitGC 手动调用将会失效) 查看tomcat的进程ID: 或者:
- ColorMatrixFilter色彩矩阵滤镜
ColorMatrixFilter色彩矩阵滤镜: /** * * *----------------------------------------* * | *** ColorMatrixFilte ...
- 记录一次mysql宕机的解决办法
首先先粘贴出来我的错误信息,如下: 2019-07-16T00:53:18.285919Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysq ...
- ASP.Net Core 2.1+ Cookie 登录授权验证【简单Cookie验证】
介绍 本文章发布于博客园:https://www.cnblogs.com/fallstar/p/11310749.html 作者:fallstar 本文章适用于:ASP.NET Core 2.1 + ...
- sql 分组后重复数据取时间最新的一条记录
1.取时间最新的记录 不分组有重复(多条CreateTime一样的都是最新记录) select * from test t where pid in ( select PId from Test t ...
- springmvc集成cxf的方法
最近需要在项目中增加webservice接口,供三方调用,下面就把集成的方法展示如下,供大家参考: 第一步:服务端的发布; 1:配置web.xml文件,添加cxf的servlet <servle ...
- Vue2.0的核心思想
Vue的核心思想为数据驱动和组件化. 一.数据驱动——双向绑定 Vue是一种MVVM框架.而DOM是数据的一个种自然映射.传统的模式是通过Ajax请求从model请求数据,然后手动的触发DOM传入数据 ...
- dpkg文件缺失问题
sudo apt-get update 命中:1 http://security.ubuntu.com/ubuntu bionic-security InRelease 命中:2 ht ...