tcpdump\u7b80\u5355\u7528\u6cd5<\/p>\n
tcpdump\u662f\u975e\u5e38\u5f3a\u5927\u7684\u7f51\u7edc\u5b89\u5168\u5206\u6790\u5de5\u5177\uff0c\u53ef\u4ee5\u5c06\u7f51\u7edc\u4e0a\u622a\u83b7\u7684\u6570\u636e\u5305\u4fdd\u5b58\u5230\u6587\u4ef6\u4ee5\u5907\u5206\u6790\u3002\u53ef\u4ee5\u5b9a\u4e49\u8fc7\u6ee4\u89c4\u5219\uff0c\u53ea\u622a\u83b7\u611f\u5174\u8da3\u7684\u6570\u636e\u5305\uff0c\u4ee5\u51cf\u5c11\u8f93\u51fa\u6587\u4ef6\u5927\u5c0f\u548c\u6570\u636e\u5305\u5206\u6790\u65f6\u7684\u88c5\u8f7d\u548c\u5904\u7406\u65f6\u95f4\u3002 <\/p>\n
\u8fd9\u7bc7\u6587\u7ae0\u53ea\u6d89\u53catcpdump\u7684\u57fa\u672c\u7528\u6cd5\uff0c\u8bf7\u8bb0\u4f4ftcpdump\u6bd4\u6211\u63cf\u8ff0\u7684\u5f3a\u5927\u7684\u591a\u3002<\/p>\n
\u9488\u5bf9\u7f51\u7edc\u63a5\u53e3\u3001\u7aef\u53e3\u548c\u534f\u8bae\u7684\u6570\u636e\u5305\u622a\u53d6\u3002\u5047\u5b9a\u4f60\u8981\u622a\u53d6\u7f51\u7edc\u63a5\u53e3eth1\uff0c\u7aef\u53e3\u53f76881\u7684tcp\u6570\u636e\u5305\u3002\u6570\u636e\u6587\u4ef6\u4fdd\u5b58\u4e3atest.pcap\u3002<\/p>\n
tcpdump -w test.pcap -i eth1 tcp port 6881<\/p>\n
\u5f88\u7b80\u5355\u5427\uff1f\u5982\u679c\u8981\u540c\u65f6\u622a\u53d6udp\u7aef\u53e3\u53f733210\u548c33220\u7684\u6570\u636e\u5305\u5462\uff1f<\/p>\n
tcpdump -w test.pcap -i eth1 tcp port 6881 or udp \\( 33210 or 33220 \\)<\/p>\n
'\\'\u662f\u8f6c\u4e49\u5b57\u7b26\uff0c\u903b\u8f91\u7b26\u53f7OR\u662f\u52a0(+)\u7684\u610f\u601d\u3002\u5176\u4ed6\u8868\u8fbe\u5f0f\u662f\u622a\u53d6\u7aef\u53e3\u53f76881\u7684tcp\u5305\u52a0\u4e0a\u7aef\u53e3\u53f733210\u548c33220\u7684UDP\u5305\u3002tcpdump\u8fc7\u6ee4\u8868\u8fbe\u5f0f\u7684and\u8fd0\u7b97\u7b26\u662f\u4ea4\u96c6\u7684\u610f\u601d\uff0c\u56e0\u6b64\u622a\u53d6\u7aef\u53e3\u53f733210\u548c33220\u7684UDP\u5305\u4f7f\u7528 or \u800c\u4e0d\u662f and\u3002and\u8fd0\u7b97\u7b26\u7684\u7528\u6cd5\u5728\u4e0b\u6587\u63cf\u8ff0\u3002<\/p>\n
\u600e\u6837\u4fdd\u5b58\u6587\u4ef6\u8bfb\u53d6\u6570\u636e\u5305\u5462\uff1f<\/p>\n
tcpdump -nnr test.pcap<\/p>\n
\u9009\u9879 -nn \u4e0d\u628a\u7f51\u7edcIP\u548c\u7aef\u53e3\u53f7\u8f6c\u6362\u6210\u540d\u5b57\uff0cr(read)\u8bfb\u53d6\u5305\u3002<\/p>\n
\u53ef\u4ee5\u6dfb\u52a0 -tttt \u9009\u9879\u4f7f\u65f6\u95f4\u6233\u683c\u5f0f\u66f4\u52a0\u53ef\u8bfb\u3002<\/p>\n
tcpdump -ttttnnr test.pcap<\/p>\n
\u600e\u6837\u9488\u5bf9IP\u622a\u53d6\u6570\u636e\uff1f<\/p>\n
\u9700\u5411tcpdump\u6307\u660eIP\u7c7b\u578b\uff0c\u76ee\u7684IP\u8fd8\u662f\u6e90IP\uff1f\u6bd4\u5982\u8981\u55c5\u63a2\u7684\u76ee\u7684IP\u4e3a10.168.28.22\uff0ctcp\u7aef\u53e3\u53f722\u3002<\/p>\n
tcpdump -w test.pcap dst 10.168.28.22 and tcp port 22<\/p>\n
\u76ee\u7684IP\u548c\u7aef\u53e3\u7684\u4ea4\u96c6(intersection)\uff0c\u4f7f\u7528and\u8fd0\u7b97\u7b26\u3002<\/p>\n
\u55c5\u63a2\u6570\u636e\u5305\u5927\u5c0f\u7f3a\u7701\u4e3a96 bytes\uff0c\u53ef\u4ee5\u6307\u5b9a -s \u6539\u53d8\u7f3a\u7701\u503c\u3002<\/p>\n
tcpdump -w test.pcap -s 1550 dst 10.168.28.22 and tcp port 22<\/p>\n
\u6709\u4e9b\u7248\u672c\u7684tcpdump\u5141\u8bb8\u6307\u5b9a\u7aef\u53e3\u8303\u56f4,\u4e0b\u8ff0\u6307\u4ee4\u4e3a\u9488\u5bf9\u4e00\u5b9a\u7aef\u53e3\u8303\u56f4\u622a\u53d6\u6570\u636e\u3002<\/p>\n
tcpdump tcp portrange 20-24<\/p>\n
\u6ce8\u610f\uff0c\u4e0a\u8ff0\u6307\u4ee4\u6ca1\u6709\u6307\u5b9a -w \u628a\u622a\u53d6\u7684\u6570\u636e\u5305\u4fdd\u5b58\u5230\u6587\u4ef6\u800c\u662f\u76f4\u63a5\u8f93\u51fa\u5230\u5c4f\u5e55\u3002<\/p>\n
\u4e0d\u77e5\u9053\u7aef\u53e3\u53f7\u4f7f\u7528tcpdump<\/p>\n
\u4e92\u8054\u7f51\u7684\u6570\u636e\u6d41\u91cf\u592a\u5927\uff0c\u53ef\u4ee5\u4f7f\u7528lsof\u641c\u7d22\u6307\u5b9a\u7aef\u53e3\u3002lsof\u7684\u4f8b\u5b50\u53ef\u4ee5\u53c2\u8003 Monitor who runs what, listen to what ports, established what connections\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
tcpdump\u7b80\u5355\u7528\u6cd5 tcpdump\u662f\u975e\u5e38\u5f3a\u5927\u7684\u7f51\u7edc\u5b89\u5168\u5206\u6790\u5de5\u5177\uff0c\u53ef\u4ee5\u5c06\u7f51\u7edc\u4e0a\u622a\u83b7\u7684\u6570\u636e\u5305\u4fdd\u5b58\u5230\u6587\u4ef6\u4ee5\u5907\u5206\u6790\u3002\u53ef\u4ee5\u5b9a\u4e49\u8fc7\u6ee4\u89c4\u5219\uff0c\u53ea\u622a\u83b7\u611f\u5174\u8da3\u7684\u6570\u636e\u5305\uff0c\u4ee5\u51cf\u5c11\u8f93\u51fa\u6587\u4ef6\u5927\u5c0f\u548c\u6570\u636e\u5305\u5206\u6790\u65f6\u7684\u88c5\u8f7d\u548c\u5904\u7406\u65f6\u95f4...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-337","post","type-post","status-publish","format-standard","hentry","category-linux-gnu"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=\/wp\/v2\/posts\/337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=337"}],"version-history":[{"count":0,"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=\/wp\/v2\/posts\/337\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.liangliang.org.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}