TCPDUMP抓包学习
一、抓包基础
1、抓网卡ens33 的包，有多大抓多大，然后保存到a.cap中
[root@localhost ~]# tcpdump -i ens33 -s -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
2、读取a.cap文件
[root@localhost ~]# tcpdump -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::15.381526 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::15.381556 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::16.383090 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::16.383121 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::17.385139 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::17.385273 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::18.385827 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::18.385866 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::19.244187 IP 192.168.10.1. > 239.255.255.250.ssdp: UDP, length
::19.387459 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::19.387517 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.390170 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
::20.390271 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
::20.438195 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [P.], seq :, ack , win , length
3、读取详细内容
[root@localhost ~]# tcpdump -A -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::13.453516 IP localhost.localdomain.ssh > 192.168.10.1.sicct: Flags [P.], seq :, ack , win , length
E...] @.@.G...
...
.....e...7q.4P.......u0.L.}H....j.....#|!..v.Y......"<....@.B~..|0.N.n..........,......v........&.(G9.b.a9...f.....Y.t.R....m... .v....B...:.......K....
::13.453754 IP 192.168.10.1.sicct > localhost.localdomain.ssh: Flags [.], ack , win , length
E..(..@...OX..
...
.....7q.4e..$P.............
::14.379791 IP 192.168.10.1 > localhost.localdomain: ICMP echo request, id , seq , length
E..<.......H..
...
...F.....abcdefghijklmnopqrstuvwabcdefghi
::14.379825 IP localhost.localdomain > 192.168.10.1: ICMP echo reply, id , seq , length
E..<e...@..E..
4、抓tcp 22端口的包
[root@localhost ~]# tcpdump -i ens33 tcp port -w a.cap
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size bytes
二、抓包筛选
1、通过操作系统筛选
[root@localhost ~]# tcpdump -r a.cap |awk '{print $3}'|sort -u
reading from file a.cap, link-type EN10MB (Ethernet)
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.
192.168.10.1.cruise-config
192.168.10.1.cruise-swroute
localhost.localdomain.http
2、通过源或目标地址筛选
[root@localhost ~]# tcpdump -n src host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455482 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455616 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455690 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::59.455768 IP 192.168.10.13.http > 192.168.10.1.: Flags [.], ack , win , length
::01.132478 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.132938 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [S.], seq , ack , win , options [mss ,nop,nop,sackOK,nop,wscale ], length
::01.134389 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], ack , win , length
::01.136378 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [.], seq :, ack , win , length : HTTP: HTTP/1.1 Forbidden
::01.136641 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP
::01.163086 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [.], ack , win , length
::01.163388 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.164423 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178354 IP 192.168.10.13.http > 192.168.10.1.cruise-config: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
::01.178523 IP 192.168.10.13.http > 192.168.10.1.cruise-swroute: Flags [P.], seq :, ack , win , length : HTTP: HTTP/1.1 Not Found
[root@localhost ~]# tcpdump -n dest host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
tcpdump: syntax error
[root@localhost ~]# tcpdump -n dst host 192.168.10.13 -r a.cap
reading from file a.cap, link-type EN10MB (Ethernet)
::59.455392 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455603 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455678 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::59.455757 IP 192.168.10.1. > 192.168.10.13.http: Flags [F.], seq , ack , win , length
::01.132300 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.132607 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.132821 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [S], seq , win , options [mss ,nop,wscale ,nop,nop,sackOK], length
::01.133059 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.134332 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET / HTTP/1.1
::01.136670 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.136736 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
::01.162692 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1
::01.163034 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1
::01.178069 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1
::01.178136 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [P.], seq :, ack , win , length : HTTP: GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1
::01.372703 IP 192.168.10.1.cruise-config > 192.168.10.13.http: Flags [.], ack , win , length
::01.381626 IP 192.168.10.1.cruise-swroute > 192.168.10.13.http: Flags [.], ack , win , length
3、筛选端口
[root@localhost ~]# tcpdump -n port -r a.cap
TCPDUMP抓包学习的更多相关文章
- linux下抓包学习--tcpdump的使用
一.为什么需要学这个 很多时候,开发环境上不会出现问题.但在测试或者现场时,总是会有很多莫名其妙的问题. 这时候,能在出问题的环境上,开启抓包,然后再去重现问题的话,这时候,就可以拿到第一手的资料了. ...
- 转：tcpdump抓包分析(强烈推荐)
转自:https://mp.weixin.qq.com/s?__biz=MzAxODI5ODMwOA==&mid=2666539134&idx=1&sn=5166f0aac71 ...
- tcpdump抓包命令
本文转自 : http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html http://www.itshouce.com.cn/l ...
- [转] Android利用tcpdump抓包
原文链接:http://mysuperbaby.iteye.com/blog/902201 Android利用tcpdump抓包 博客分类: Android AndroidAccessGoHTML ...
- TCPdump抓包命令详解--摘
http://blog.csdn.net/s_k_yliu/article/details/6665673/ http://starsliao.blog.163.com/blog/static/890 ...
- Android手机tcpdump抓包
在开发过程中遇到问题时,无法非常方便的获取到数据包,导致分析解决问题比较麻烦.这里介绍如何在Android手机上实现tcpdump抓包. 1.root机器 在用tcpdump抓包过程中,需要使用 ...
- Wireshark和TcpDump抓包分析心得
Wireshark和 TcpDump抓包分析心得 1. Wireshark与tcpdump介绍 Wireshark是一个网络协议检测工具,支持Windows平台和Unix平台,我一般只在Window ...
- tcpdump 抓包让wireshark来分析
在linux下面用tcpdump 抓包非常方便, 但是抓的包要提取出来进行分析, 还是得用wireshark来过滤分析比较方便. 下面先介绍一下 TCPDUMP 的使用 例:tcpdump host ...
- tcpdump抓包并保存成cap文件
首选介绍一下tcpdump的常用参数 tcpdump采用命令行方式,它的命令格式为: tcpdump [ -adeflnNOpqStvx ] [ -c 数量 ] [ -F 文件名 ] [ -i 网络接 ...
随机推荐
- 用GDB调试程序（四）
查看栈信息————— 当程序被停住了,你需要做的第一件事就是查看程序是在哪里停住的.当你的程序调用了一个函数,函数的地址,函数参数,函数内的局部变量都会被压入“栈”(Stack)中.你可以用GDB命令 ...
- 【LEETCODE】37、122题，Best Time to Buy and Sell Stock II
package y2019.Algorithm.array; /** * @ProjectName: cutter-point * @Package: y2019.Algorithm.array * ...
- 状态机的Verilog写法
“硬件设计很讲究并行设计思想,虽然用Verilog描述的电路大都是并行实现的,但是对于实际的工程应用,往往需要让硬件来实现一些具有一定顺序的工作,这就要用到状态机思想.什么是状态机呢?简单的说,就是通 ...
- Spring Cloud--实现Eureka的高可用（Eureka集群搭建）实例
将10086注册到10087上: 再在10086服务的基础上复制一个Eureka的服务,端口为10087,将其注册到10086上: application-name的名称保持一致,只是一个服务的两个实 ...
- 手贱删了一些不该删的东西，导致git pull每次都要输入账号密码...
解决办法: 输入一次账号密码,然后git工程目录下执行 git config --global credential.helper store 就妥了.
- 在 WPF 中获取一个依赖对象的所有依赖项属性
原文:在 WPF 中获取一个依赖对象的所有依赖项属性 本文介绍如何在 WPF 中获取一个依赖对象的所有依赖项属性. 本文内容 通过 WPF 标记获取 通过设计器专用方法获取 通过 WPF 标记获取 p ...
- 第三方dll签名
1.打开vs Tools下的工具命令 2.生成随机密钥对C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC>sn -k NonSignL ...
- 【洛谷 P4688】 [Ynoi2016]掉进兔子洞（bitset，莫队）
题目链接 第一道Ynoi 显然每次询问的答案为三个区间的长度和减去公共数字个数*3. 如果是公共数字种数的话就能用莫队+bitset存每个区间的状态,然后3个区间按位与就行了. 但现在是个数,bits ...
- OO——UML解析
目录 第四单元博客作业 一.前两次作业架构设计 1. 第一次作业 2. 第二次作业 二.架构设计以及对OO方法理解的演进 1. 表达式求导 2. 多线程电梯 3. 地铁线路查询 4. UML图的解析 ...
- LeetCode算法01 Valid Parentheses
Given a string containing just the characters '(', ')', '{', '}', '[' and ']', determine if the inpu ...