Home > Article > System Tutorial > Common examples of tcpdump
Common examples of tcpdump
- PHPzforward
- 2024-04-02 09:19:10839browse
tcpdump is a very commonly used network packet analysis tool that can be used to display TCP/IP and other network data packets transmitted to the system through the network. tcpdump Use the libpcap library to capture network packets. This library is available in almost all Linux/Unix.
tcpdump The content can be read from the network card or a previously created packet file, or the packet can be written to a file for subsequent use. Must be root or use sudo privileges to run tcpdump.
In this article, we will demonstrate how to use the tcpdump command through some examples, but first let us take a look at how to install tcpdump in various Linux operating systems. of.
tcpdump It is available by default in almost all Linux distributions, but if it is not available on your Linux, use the method below to install it.
Use the following commands to install on CentOS and RHEL tcpdump,
$ sudo yum install tcpdump*
Use the following command to install tcpdump on Fedora:
$ dnf install tcpdump
Use the following command to install tcpdump on Ubuntu/Debain/Linux Mint:
$ apt-get install tcpdump
After installing tcpdump, now let’s look at some examples.
Run the following command to capture packets from all network cards:
$ tcpdump -i any
To capture packets from the specified network card, run:
$ tcpdump -i eth0
使用 -w 选项将所有捕获的包写入文件：
$ tcpdump -i eth1 -w packets_file
使用下面命令从之前创建的 tcpdump 文件中读取内容：
$ tcpdump -r packets_file
要获取更多的包信息同时以可读的形式显示时间戳，使用：
$ tcpdump -ttttnnvvS
要获取整个网络的数据包，在终端执行下面命令：
$ tcpdump net 192.168.1.0/24
要获取指定 IP 的数据包，不管是作为源地址还是目的地址，使用下面命令：
$ tcpdump host 192.168.1.100
要指定 IP 地址是源地址或是目的地址则使用：
$ tcpdump src 192.168.1.100 $ tcpdump dst 192.168.1.100
要查看某个协议的数据包，运行下面命令：
$ tcpdump ssh
要捕获某个端口或一个范围的数据包，使用：
$ tcpdump port 22 $ tcpdump portrange 22-125
我们也可以与 src 和 dst 选项连用来捕获指定源端口或指定目的端口的报文。
我们还可以使用“与” （and，&&）、“或” （or，|| ) 和“非”（not，!） 来将两个条件组合起来。当我们需要基于某些条件来分析网络报文是非常有用。
可以使用 and 或者符号 && 来将两个或多个条件组合起来。比如：
$ tcpdump src 192.168.1.100 && port 22 -w ssh_packets
“或”会检查是否匹配命令所列条件中的其中一条，像这样：
$ tcpdump src 192.168.1.100 or dst 192.168.1.50 && port 22 -w ssh_packets $ tcpdump port 443 or 80 -w http_packets
当我们想表达不匹配某项条件时可以使用“非”，像这样：
$ tcpdump -i eth0 src port not 22
这会捕获 eth0 上除了 22 号端口的所有通讯。
我们的教程至此就结束了，在本教程中我们讲解了如何安装并使用 tcpdump 来捕获网络数据包。
The above is the detailed content of Common examples of tcpdump. For more information, please follow other related articles on the PHP Chinese website!