1、tcpdump的参数信息
-n 不转换主机地址到主机名，这样用于避免DNS解析
-i 指定网络接口
-e 增加以太网帧头部信息输出
-v 输出更详细的信息
2、抓取vlan的信息
# tcpdump -ni em2 -v -e | grep vlan tcpdump: WARNING: em2: no IPv4 address assigned tcpdump: listening on em2, link-type EN10MB (Ethernet), capture size 65535 bytes 17:32:16.532355 00:e0:4c:84:5c:a3 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.26 tell 172.16.1.99, length 46 17:32:16.568647 06:4b:36:00:00:46 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 24184, offset 0, flags [none], proto VRRP (112), length 40) 17:32:16.666799 18:66:da:eb:00:10 > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 172, p 0, ethertype IPv4, (tos 0x0, ttl 128, id 23044, offset 0, flags [none], proto UDP (17), length 78) 17:32:16.840217 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.28 tell 172.16.1.152, length 46 17:32:16.855502 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.27 tell 172.16.1.152, length 46 17:32:16.863344 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.27 tell 172.16.1.151, length 46 17:32:16.863778 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.28 tell 172.16.1.151, length 46 17:32:16.894936 06:0b:1e:00:00:7f > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 11523, offset 0, flags [none], proto VRRP (112), length 40) 17:32:16.895184 06:7a:e4:00:00:29 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 47219, offset 0, flags [none], proto VRRP (112), length 40) 17:32:17.287184 06:a6:8e:00:00:10 > 33:33:00:01:00:02, ethertype 802.1Q (0x8100), length 161: vlan 173, p 0, ethertype IPv6, (hlim 1, next-header UDP (17) payload length: 103) fe80::89e9:16fa:9921:a2de.dhcpv6-client > ff02::1:2.dhcpv6-server: [udp sum ok] dhcp6 solicit (xid=343686 (elapsed-time 703) (client-ID hwaddr/time type 1 time 556803887 06a68e000010) (IA_NA IAID:302422322 T1:0 T2:0) (Client-FQDN) (vendor-class) (option-request DNS-search-list DNS-server vendor-specific-info Client-FQDN)) 17:32:17.300035 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.26 tell 172.16.1.152, length 46 17:32:17.392404 00:e0:4c:84:5c:a3 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.27 tell 172.16.1.99, length 46 17:32:17.430664 18:66:da:eb:00:10 > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 172, p 0, ethertype IPv4, (tos 0x0, ttl 128, id 24752, offset 0, flags [none], proto UDP (17), length 78) 17:32:17.568896 06:4b:36:00:00:46 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 24185, offset 0, flags [none], proto VRRP (112), length 40) 17:32:17.799903 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.28 tell 172.16.1.152, length 46 17:32:17.799936 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.27 tell 172.16.1.152, length 46 17:32:17.864017 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.27 tell 172.16.1.151, length 46 17:32:17.864393 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.28 tell 172.16.1.151, length 46 17:32:17.896318 06:7a:e4:00:00:29 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 47220, offset 0, flags [none], proto VRRP (112), length 40) 17:32:17.896327 06:0b:1e:00:00:7f > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 11524, offset 0, flags [none], proto VRRP (112), length 40) 17:32:18.154418 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 176, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80b0.2c:31:24:34:1c:80.8009, length 42 17:32:18.154818 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 177, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80b1.2c:31:24:34:1c:80.8009, length 42 17:32:18.155353 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 178, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80b2.2c:31:24:34:1c:80.8009, length 42 17:32:18.164715 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 180, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80b4.2c:31:24:34:1c:80.8009, length 42 17:32:18.165125 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 179, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80b3.2c:31:24:34:1c:80.8009, length 42 17:32:18.195014 18:66:da:eb:00:10 > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 172, p 0, ethertype IPv4, (tos 0x0, ttl 128, id 26667, offset 0, flags [none], proto UDP (17), length 78) 17:32:18.392359 00:e0:4c:84:5c:a3 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.27 tell 172.16.1.99, length 46 17:32:18.411455 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.217 tell 172.16.1.254, length 50 17:32:18.411660 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.23 tell 172.16.1.254, length 50 17:32:18.411872 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.210 tell 172.16.1.254, length 50 17:32:18.412088 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.1.181 tell 172.16.1.254, length 50 17:32:18.473644 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 192, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80c0.2c:31:24:34:1c:80.8009, length 42 17:32:18.474051 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 253, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80fd.2c:31:24:34:1c:80.8009, length 42 17:32:18.474575 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 254, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80fe.2c:31:24:34:1c:80.8009, length 42 17:32:18.475530 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 1000, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 83e8.2c:31:24:34:1c:80.8009, length 42 17:32:18.476037 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 173, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80ad.2c:31:24:34:1c:80.8009, length 42 17:32:18.483481 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 174, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80ae.2c:31:24:34:1c:80.8009, length 42 17:32:18.485569 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80ac.2c:31:24:34:1c:80.8009, length 42 17:32:18.486260 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:cd, ethertype 802.1Q (0x8100), length 68: vlan 175, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-id 80af.2c:31:24:34:1c:80.8009, length 42 17:32:18.569139 06:4b:36:00:00:46 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255, id 24186, offset 0, flags [none], proto VRRP (112), length 40) 17:32:18.691450 54:c4:15:51:8e:de > 01:00:5e:7f:ff:fa, ethertype 802.1Q (0x8100), length 184: vlan 254, p 0, ethertype IPv4, (tos 0x0, ttl 4, id 0, offset 0, flags [DF], proto UDP (17), length 166)
说明：此命令适用于调试Linux网络时候，查看vlan相关的tag信息，存档，备忘。