tcpdump命令

语法:
tcpdump [options] [Protocol] [Direction] [Host(s)] [Value] [Logical Operations] [Other expression]

Protocol(协议):
Values(取值):ether,fddi,ip,arp,rarp,decnet,lat,sca,moprc,mopdl,tcp and udp.
If no protocol is specified, all the prorocols are used

Direction(流向):
If no source of destination is specified,the "src or dst" keywords are applied.(默认是src or dst).
For example, "host 10.2.2.2" is equivalent to "src or dst host 10.2.2.2".

Host(s)(主机):
Values(替代关键字):net,port,host,portrange.
If no host(s) is specified, the "host" keyword is used.默认如果此段没有指定关键字,默认即host.
For example, "src 10.1.1.1" is equivalent ro "src host 10.1.1.1".

Logical Operations:
(1)AND
and or &&
(2)OR
or or ||
(3)EXCEPT
not or !

参数说明:
-i any:Listen on all interfaces just to see if you're seeing any traffic.(指定接口)
-n:Don't resolve hostnames.(不反解主机名)
-nn:Don't resolve hostnames or port name.(不反解主机名,也不反解端口号对应的服务名)
-X:Show the packets's contents in both hex and ASCII.(把报文内容转为ASCII方式显示)
-XX:Same as -X,but also shows the ethernet header.(包含-X,同时会显示以太网帧首部信息)
-v,-vv,-vvv:Increase the amount of packet information you get back.(显示详细信息)
-c #:Only get x number of packets and then stop.(制定抓包的个数)
-s:Define the snaplength(size) of the capture in bytes. Use -s0 to get everything,unless you are intentionally capturing less.()
-S:Print absolute sequence numbers.(显示报文的序列号)
-e:Get the ethernet header as well.(显示以太网首部信息)
-q:Show less protocol information.(显示更少的协议信息)
-E:Decrypt IPSEC traffic by providing an encryption key.(通过提供一个加密密钥解密IPSEC传输信息)
-A:Display Cpatured Packets in ASCII.(把报文内容转为ASCII方式显示)
-w /path/from/some_file:Capture the packets from a saved file.(捕获的数据包保存文件)
-r /path/from/some_file:Reading the packets from a saved file.(读取捕获的数据包文件信息)
-tttt:Capture packets with proper readable timestamp.(捕获数据包通过适当的可读的时间戳)

例子:
抓取eht1的所有报文信息,并以
tcpdump -i eth1 -nn -XX ip dst host 192.168.2.2 and tcp dst port 3306

posted @ 2017-03-13 13:50  fansik  阅读(140)  评论(0编辑  收藏  举报