Most Common Linux Commands

netcat — a utility that is able to write and read data across TCP and UDP network connections.

  • -v: produce more verbose(冗余的) output
  • -w timeout: connections which cannot be established or are idle timeout after timeout second.
  • -z: only scan for listening daemon, without sending any data to them.
  • -n: do not do any DNS or service lookups on any address, hostname or ports.
  • -l: listen for an incoming connection rather than initiating a connection to a remote host.
  • -k: when a connection is completed, listen for another one.
  • -p source_port: specify the source port nc should use.
  • -u: use UDP instead of TCP.

(1) nc -v -w 2 -z target 22-23: try connecting to every port in [22, 23] at the target

ports scanning

(2) nc -v -n target 443: grab port banners at target:443
grab port banners

(3) nc -l -p 10001: listen for an incoming connection on port 10001.
(4) Transferring files using netcat:

// server
nc -l -p 1234 > filename.txt

// client
nc destination 1234 < filename.txt

wc — print new line, word and byte counts for each file

  • -l: print the new line counts.
  • -w: print the word counts.
  • -m: print the character counts.
  • -c: print the byte counts.

(1) wc file: print number of lines, number of words, number of bytes, filename for file

wc co_routine.cpp

(2) ls -l | wc -l: count the number of files in current directory
count file number

tcpdump — dump traffic on a network

  • -A: print each packet (minus its link level header) in ASCII.
  • -X: print each packet (minus its link level header) in hex and ASCII.
  • -i interface: select interface that the capture is to take place on.
  • -n: don’t convert host addresses to names.
  • -nn: don’t convert protocol and port numbers etc. to names either.
  • -s snaplen: snarf snaplen bytes of data from each packet rather than the default of 65535 bytes.
  • -S: Print absolute, rather than relative, TCP sequence numbers.
  • -v, -vv, -vvv: show more protocol specific information.

pcap-filter — packet filter syntax

  • port port: either the source or destination port of the packet is port.
  • host host: either the source or destination of the packet is host.
  • src host host/src port port: the source of the packet is host/port.
  • dst host host/dst port port: the destination of the packet is host/port.

(1) tcpdump -nn -vv port 80: capture traffic on port 80

Flags are some combination of S(SYN), F(FIN), P(PUSH), R(RST), W(ECN CWR) or E (ECN-Echo), or a single ‘.’ (no flags).

capture port 80

(2) tcpdump -A port 8080:
tcpdump ASCII

(3) tcpdump -A dst port 1234: capture on destination port
capture on destination port

ss -- used to dump socket statistics

  • no option: displays a list of open non-listening sockets(e.g. TCP/UNIX/UDP) that have established connection.
  • -t: Display TCP sockets.
  • -u: Display UDP sockets.
  • -x: Display Unix domain sockets.
  • -a: Display both listening and non-listening (for TCP this means established connections) sockets.
  • -n: Do not try to resolve service names.
  • -l: Display only listening sockets (these are omitted by default).
  • -p: Show the process name/pid which owns the connection.
  • -s: Print summary statistics.
  • -4: Display only IP version 4 sockets
  • -6: Display only IP version 6 sockets
  • [ state TCP-STATE ] [ EXPRESSION ]: Filtering connections by tcp state or EXPRESSION

STATE-FILTER allows to construct arbitrary set of states to match. Its syntax is sequence of keywords state and exclude followed by identifier of state.
Available identifiers are:

  • all standard TCP states: established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening and closing.
  • all - for all the states
  • connected - all the states except for listening and closed
  • synchronized - all the connected states except for syn-sent
  • bucket - states, which are maintained as minisockets, i.e. time-wait and syn-recv
  • big - opposite to bucket

(1) ss -tu: filter out tcp and udp connections

ubuntu@VM-100-62-ubuntu:~$ ss -tu
Netid     State       Recv-Q       Send-Q              Local Address:Port                Peer Address:Port       
tcp       ESTAB       0            0                   10.xxx.100.xx:ssh                61.xxx.169.xx:30199      
tcp       ESTAB       0            0                   10.xxx.100.xx:42710             10.xxx.231.xxx:5574       

你可能感兴趣的:(Most Common Linux Commands)