mac上tcpdump 简单使用说明

查看网卡

sudo tcpdump -D

1.en0 [Up, Running]
2.p2p0 [Up, Running]
3.awdl0 [Up, Running]
4.llw0 [Up, Running]
5.utun0 [Up, Running]
6.en1 [Up, Running]
7.utun1 [Up, Running]
8.en2 [Up, Running]
9.utun2 [Up, Running]
10.en3 [Up, Running]

11.en4 [Up, Running]
12.en8 [Up, Running]
13.lo0 [Up, Running, Loopback]
14.gif0
15.stf0
16.bridge0
17.ap1

 

监听 报文

 

tcpdump -i 2 host 1.1.11.3 and udp port 5066

 

-i 指的是监听第2块网卡

host 指的是要监听的ip

udp 指的是监听udp报文

port 指的是监听指定的端口