TCPDUMP

Author: Xu FC

TCPDUMP 参数

-c <number>: 指定抓包个数

tcpdump -c 2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
05:55:13.756478 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2630991455:2630991651, ack 3844704184, win 255, length 196
05:55:13.757398 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 196:376, ack 1, win 255, length 180
2 packets captured
2 packets received by filter
0 packets dropped by kernel

-i <interface>: 指定目标端口

tcpdump -i eth0 -c 1
05:28:56.313349 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 645536:645700, ack 365, win 255, length 164
1 packets captured
1 packets received by filter
0 packets dropped by kernel

-q: 打印少量协议相关内容

tcpdump -i any -q -c 1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
05:56:23.517366 IP 193.1.3.11.ssh > 193.1.3.2.51871: tcp 196
1 packet captured
17 packets received by filter
0 packets dropped by kernel

-v: 显示详细内容, -vv, -vvv

tcpdump -i any -c 1 -vvv
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
05:57:29.524244 IP (tos 0x10, ttl 64, id 57549, offset 0, flags [DF], proto TCP (6), length 172)
    193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], cksum 0x88ae (incorrect -> 0x2d8b), seq 2630995235:2630995367, ack 3844705656, win 255, length 132
1 packet captured
18 packets received by filter
0 packets dropped by kernel

-w <file_name>: 将抓包结果保存到文件中

tcpdump -i any -c 1 -w file.cap
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
1 packet captured
1 packet received by filter
0 packets dropped by kernel

-r <file_name>: 从文件中读取数据

tcpdump -r file.cap 
reading from file file.cap, link-type LINUX_SLL (Linux cooked)
05:58:16.533695 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2630996863:2630996995, ack 3844706644, win 255, length 132

基于协议过滤

arp: 过滤 ARP

tcpdump  -c 2 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:24:22.276090 ARP, Request who-has 193.1.2.52 tell 193.1.2.141, length 46
01:24:22.276140 ARP, Request who-has 193.1.2.62 tell 193.1.2.141, length 46
2 packets captured
2 packets received by filter
0 packets dropped by kernel

icmp,tcp, udp...

tcpdump  -c 1 tcp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:25:44.395200 IP 193.1.1.231.ssh > 193.1.1.110.52972: Flags [P.], seq 2915666324:2915666440, ack 3897014413, win 264, length 116
1 packet captured
7 packets received by filter
0 packets dropped by kernel

基于 IP 地址的过滤

host <IP address>: 过滤源 IP 或者目的 IP 为指定 IP 地址的包

tcpdump -c 1 host 193.1.3.11 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:01:59.130264 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631002191:2631002387, ack 3844711220, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

src/dst <IP address>: 过滤源/目的 IP

tcpdump -c 1 src 193.1.3.11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:06:12.125502 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631002819:2631003015, ack 3844711340, win 255, length 196
1 packet captured
3 packets received by filter
0 packets dropped by kernel

net <sub net>: 过滤源 IP 或者目的 IP 在指定子网的包

tcpdump -c 1 net 193.1.3.0/24
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:09:01.518140 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631005067:2631005263, ack 3844712968, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

src/dst net <sub net>: 过滤源/目的 IP 地址在指定子网范围的包

tcpdump -c 1 src net 193.1.3.0/24
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:10:27.133894 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631005711:2631005907, ack 3844713104, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

基于 port 过滤

port <port>: 过滤源 port 或者目的 port 为指定 port 的包

tcpdump -c 1 port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:12:44.258223 IP 193.1.3.11.ssh > 193.1.3.2.51871: Flags [P.], seq 2631006339:2631006535, ack 3844713224, win 255, length 196
1 packet captured
1 packet received by filter
0 packets dropped by kernel

src/dst port: 过滤源/目的 port

tcpdump -c 1 src net 193.1.3.0/24 and not src port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on atcp_veth0, link-type EN10MB (Ethernet), capture size 65535 bytes
06:13:44.650217 IP 193.1.3.2.51871 > 193.1.3.11.ssh: Flags [.], ack 2631007195, win 16321, length 0
1 packet captured
1 packet received by filter
0 packets dropped by kernel

基于 TCP flag 过滤

tcp[13] & 2!=0: 过滤 SYN

tcpdump  -c 2 net 193.0.0.0/8 and "tcp[13] & 2 != 0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:22:49.679842 IP 193.1.1.110.53106 > 193.1.1.231.ssh: Flags [S], seq 423562932, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
01:22:49.679922 IP 193.1.1.231.ssh > 193.1.1.110.53106: Flags [S.], seq 1364181361, ack 423562933, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
2 packets captured
2 packets received by filter
0 packets dropped by kernel

tcp[13] & 16 !=0: 过滤 ACK

tcpdump  -c 2 net 193.0.0.0/8 and "tcp[13] & 16!=0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:27:47.239368 IP 193.1.1.231.ssh > 193.1.1.110.52972: Flags [P.], seq 2915667924:2915668120, ack 3897015017, win 264, length 196
01:27:47.245847 IP 193.1.1.231.ssh > 193.1.1.110.52972: Flags [P.], seq 196:376, ack 1, win 264, length 180
2 packets captured
2 packets received by filter
0 packets dropped by kernel

tcp[13]=18: 过滤 SYN ACK

tcpdump net 193.0.0.0/8 and "tcp[13]=18"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:30:13.419672 IP 193.1.1.231.ssh > 193.1.1.110.53677: Flags [S.], seq 1820623300, ack 1594275082, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel

tcp[13] & 4!=0: 过滤 RST

tcpdump "tcp[13] & 4!=0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:31:43.821051 IP 193.1.1.231.microsoft-ds > 193.1.1.62.56513: Flags [R.], seq 0, ack 3270176790, win 0, length 0

tcp[13] & 1!=0: 过滤 FIN

tcpdump "tcp[13] & 1!=0"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
01:33:36.082121 IP 193.1.1.231.ssh > 193.1.1.110.53939: Flags [F.], seq 3223250025, ack 2445636549, win 246, length 0
01:33:36.082691 IP 193.1.1.110.53939 > 193.1.1.231.ssh: Flags [F.], seq 1, ack 1, win 16412, length 0

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 204,684评论 6赞 478
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 87,143评论 2赞 381
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 151,214评论 0赞 337
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 54,788评论 1赞 277
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 63,796评论 5赞 368
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,665评论 1赞 281
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 38,027评论 3赞 399
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,679评论 0赞 258
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 41,346评论 1赞 299
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,664评论 2赞 321
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,766评论 1赞 331
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 33,412评论 4赞 321
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 39,015评论 3赞 307
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,974评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,203评论 1赞 260
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 45,073评论 2赞 350
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 42,501评论 2赞 343

TCPDUMP

TCPDUMP 参数

基于协议过滤

基于 IP 地址的过滤

基于 port 过滤

基于 TCP flag 过滤

推荐阅读更多精彩内容