TCPDUMP

超级详细Tcpdump 的用法

由 故事扮演 提交于 2020-01-09 12:58:14
第一种是关于类型的关键字，主要包括host，net，port, 例如 host 210.27.48.2，指明 210.27.48.2是一台主机，net 202.0.0.0 指明 202.0.0.0是一个网络地址，port 23 指明端口号是23。如果没有指定类型，缺省的类型是host. 第二种是确定传输方向的关键字，主要包括src , dst ,dst or src, dst and src ,这些关键字指明了传输的方向。举例说明，src 210.27.48.2 ,指明ip包中源地址是210.27.48.2 , dst net 202.0.0.0 指明目的网络地址是202.0.0.0 。如果没有指明方向关键字，则缺省是src or dst关键字。 第三种是协议的关键字，主要包括fddi,ip,arp,rarp,tcp,udp等类型。Fddi指明是在FDDI(分布式光纤数据接口网络)上的特定 的网络协议，实际上它是"ether"的别名，fddi和ether具有类似的源地址和目的地址，所以可以将fddi协议包当作ether的包进行处理和 分析。其他的几个关键字就是指明了监听的包的协议内容。如果没有指定任何协议，则tcpdump将会监听所有协议的信息包。 除了这三种类型的关键字之外，其他重要的关键字如下：gateway, broadcast,less,greater,还有三种逻辑运算

超级详细Tcpdump 的用法

由 怎甘沉沦 提交于 2020-01-09 05:26:24
第一种是关于类型的关键字，主要包括host，net，port, 例如 host 210.27.48.2，指明 210.27.48.2是一台主机，net 202.0.0.0 指明 202.0.0.0是一个网络地址，port 23 指明端口号是23。如果没有指定类型，缺省的类型是host. 第二种是确定传输方向的关键字，主要包括src , dst ,dst or src, dst and src ,这些关键字指明了传输的方向。举例说明，src 210.27.48.2 ,指明ip包中源地址是210.27.48.2 , dst net 202.0.0.0 指明目的网络地址是202.0.0.0 。如果没有指明方向关键字，则缺省是src or dst关键字。 第三种是协议的关键字，主要包括fddi,ip,arp,rarp,tcp,udp等类型。Fddi指明是在FDDI(分布式光纤数据接口网络)上的特定 的网络协议，实际上它是"ether"的别名，fddi和ether具有类似的源地址和目的地址，所以可以将fddi协议包当作ether的包进行处理和 分析。其他的几个关键字就是指明了监听的包的协议内容。如果没有指定任何协议，则tcpdump将会监听所有协议的信息包。 除了这三种类型的关键字之外，其他重要的关键字如下：gateway, broadcast,less,greater,还有三种逻辑运算

tcpdump的详细用法

由 丶灬走出姿态 提交于 2020-01-08 21:45:40
/*--> */ /*--> */ 第一种是关于类型的关键字，主要包括host，net，port, 例如 host 210.27.48.2，指明 210.27.48.2是一台主机，net 202.0.0.0 指明 202.0.0.0是一个网络地址，port 23 指明端口号是23。如果没有指定类型，缺省的类型是host. 第二种是确定传输方向的关键字，主要包括src , dst ,dst or src, dst and src ,这些关键字指明了传输的方向。举例说明，src 210.27.48.2 ,指明ip包中源地址是210.27.48.2 , dst net 202.0.0.0 指明目的网络地址是202.0.0.0 。如果没有指明方向关键字，则缺省是src or dst关键字。 第三种是协议的关键字，主要包括fddi,ip,arp,rarp,tcp,udp等类型。Fddi指明是在FDDI(分布式光纤数据接口网络)上的特定 的网络协议，实际上它是"ether"的别名，fddi和ether具有类似的源地址和目的地址，所以可以将fddi协议包当作ether的包进行处理和 分析。其他的几个关键字就是指明了监听的包的协议内容。如果没有指定任何协议，则tcpdump将会监听所有协议的信息包。 除了这三种类型的关键字之外，其他重要的关键字如下：gateway, broadcast,less

tcpdump 抓包使用小结

由 眉间皱痕 提交于 2020-01-08 02:05:40
tcpdump 抓包规则常用命令 下面的例子全是以抓取 eth0 接口为例，如果不加”-i eth0” 是表示抓取所有的接口包括 lo 12345678910111213141516171819202122232425262728293031323334353637383940414243 # 抓取包含 172.16.1.122 的数据包 tcpdump -i eth0 -vnn host 172.16.1.122 # 抓取包含 172.16.1.0/24 网段的数据包 tcpdump -i eth0 -vnn net 172.16.1.0/24 # 抓取包含端口 22 的数据包 tcpdump -i eth0 -vnn port 22 # 抓取 udp 协议的数据包 tcpdump -i eth0 -vnn udp # 抓取 icmp 协议的数据包 tcpdump -i eth0 -vnn icmp # 抓取 arp 协议的数据包 tcpdump -i eth0 -vnn arp # 抓取 ip 协议的数据包 tcpdump -i eth0 -vnn ip # 抓取源 ip 是 172.16.1.122 数据包。 tcpdump -i eth0 -vnn src host 172.16.1.122 # 抓取目的 ip 是 172.16.1.122 数据包 tcpdump -i

Write tcpdump output in a text file into a single line

由 生来就可爱ヽ(ⅴ＜●) 提交于 2020-01-05 04:09:09
问题 I want to concatenate all lines in text output into one line. With the following command I can monitor DHCP traffic: tcpdump -lni eth0 -vvv -s 1500 '((udp port 67) and (udp[247:4] = 0x63350103))' | grep --line-buffered -E -i 'client-id|requested-ip|hostname' For every new connection I see 3 results ( IP, MAC, Hostname ) every one of them on a new line. That's possible to write this three every results but into only one line and write on a file? 回答1: Use tr to remove newlines with -d. Running

Android emulator fails to start when used with tcpdump-option on Windows10

由 ＊爱你＆永不变心＊ 提交于 2020-01-04 04:01:49
问题 I can run an avd using cmd on Windows 10 with the command: emulator -avd avdmy but when I want to use tcpdump to capture the network-traffic, the emulator fails to start: emulator -avd avdmy -tcpdump ~/test.cap qemu-system-i386.exe: -tcpdump: invalid option I have no problems running the emulator itself. Might this be a Bug or am I missing something? The problem occurrs for every AVD I've tried. I've checked emulator -help and I am sure -tcpdump is an option. My question is do I need tcpdump

ReadLine on TCPDump-Buffer sometimes blocks until kill tcpdump

由 倾然丶 夕夏残阳落幕 提交于 2020-01-03 02:05:25
问题 I have a problem using TCPDump from my Android-Application. It is supposed to read the output from tcpdump line by line and process it within my Application. The Problem is: Sometimes the code works fine, it reads the captured packets immediately. But sometimes, ReadLine blocks until I kill the tcpdump process from the Linux-Console (killall tcpdump). After doing that, my loop is processed for each line (sometimes 10, sometimes 1 or 2) - which means, the readLine should have worked, but didn

ReadLine on TCPDump-Buffer sometimes blocks until kill tcpdump

由 懵懂的女人 提交于 2020-01-03 02:05:11
问题 I have a problem using TCPDump from my Android-Application. It is supposed to read the output from tcpdump line by line and process it within my Application. The Problem is: Sometimes the code works fine, it reads the captured packets immediately. But sometimes, ReadLine blocks until I kill the tcpdump process from the Linux-Console (killall tcpdump). After doing that, my loop is processed for each line (sometimes 10, sometimes 1 or 2) - which means, the readLine should have worked, but didn

How do you Identify the interface of a packet while listening to network traffic on all devices?

由 我的梦境 提交于 2020-01-02 20:09:11
问题 I am writing a python program that needs to listening to traffic on all networking devices and identify packets based on their incoming interface. To listen on all interfaces I started my capture without specify a device, but I am unable to denote the interface of a particular packet. How is this done? 回答1: I assume that the MAC address is sufficient information for you. The first 6 octets of a packet is the destination MAC address, which is immediately followed by the 6 octets of source MAC

capture network traffic on two different ports simultaneously

由 若如初见. 提交于 2020-01-02 07:14:11
问题 I wish to capture tcpdump traffic on two different ports simultaneouly . I tried this .. $ tcpdump port 21 ; tcpdump port 22 Althoug it worked but problem is first it will wait for traffic on port 21 and when interrupted then it will wait for port 22. Also another problem is it will not capture the traffic on port 22 untill traffic on port 21 will be captured. I want an order free solution means in whatever order packet arrives if they are for port 21 or 22 they should be captured . Please
订阅 TCPDUMP