TCPDUMP使用

tcpdump tcp -i wlan0 -t -s 0 -c 100 and \(src net 192.168.199.176 or dst net 192.168.199.176 \) and  \( tcp[20:2]=0x4745 or tcp[20:2]=0x4854\) -w ./t
arget.cap

抓取192.168.199.176所有HTTP包

 

详情：http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html

http://www.cnblogs.com/jiangz/archive/2013/04/04/2997047.html