How to perform packet capture command in linux

Linux can use the tcpdump command, tshark command and ngrep command to capture packets. Detailed introduction: 1. tcpdump command, which can capture network data packets and display or save them; 2. tshark command, which can capture packets without using a graphical interface; 3. ngrep command, which can be used to capture and filter network data Bag.

In Linux system, you can use the following command to capture packets:

tcpdump command:

tcpdump [options] [filters]

This is a powerful command line packet capture tool that can capture network packets and display or save them. For example, to capture HTTP traffic on all network interfaces, you can use the following command:

sudo tcpdump -i any port 80

tshark command:

tshark [options] [filters]

This is the command line version of Wireshark that can Capture packets without using a graphical interface. It provides similar functionality to Wireshark. For example, to capture packets from a specific IP address, you can use the following command:

sudo tshark -i any host 192.168.0.1

ngrep command:

ngrep [options] [filters]

This is a command line tool similar to grep , can be used to capture and filter network data packets. It can match captured packets based on regular expressions. For example, to capture all HTTP requests containing "GET", you can use the following command:

sudo ngrep -q -d any 'GET' port 80

Please note that the above command needs to be run with root privileges because packet capture requires access to the network interface.

The above is the detailed content of How to perform packet capture command in linux. For more information, please follow other related articles on the PHP Chinese website!