tcpdump粗略总结

 

       只是笔记，有待研究，望大家多提宝贵意见。

 

man手册 + 网络搜索

 

 

       tcpdump [ -AdDeflLnNOpqRStuUvxX ] [ -c count ]

               [ -C file_size ] [ -F file ]

               [ -i interface ] [ -m module ] [ -M secret ]

               [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]

               [ -W filecount ]

               [ -E spi@ipaddr algo:secret,...  ]

               [ -y datalinktype ] [ -Z user ]

               [ expression ]

 

 

 

tcpdump - dump traffic on a network

-c n 接收到指定数量(n个)的数据包后退出

-D 通俗来说就是显示系统中可用网卡(a number and a interface name)

-e 显示数据链路层的数据报文(如：显示mac地址信息)

-F 使用文件作为规则表达式，命令行中的将被忽略

-i 指定监听的网卡

-n 不把主机地址转换为主机名(避开DNS查询)

-nn 不把协议和端口号转换为名称

-q 显示较少的协议信息

 

下面的源自：http://www.51cto.com/html/2005/1226/15473.htm

第一种是关于类型的关键字，主要包括host，net，port, 例如 host 210.27.48.2，指明 210.27.48.2是一台主机，net 202.0.0.0 指明 202.0.0.0是一个网络地址，port 23 指明端口号是23。如果没有指定类型，缺省的类型是host.
第二种是确定传输方向的关键字，主要包括src , dst ,dst or src, dst and src ,这些关键字指明了传输的方向。举例说明，src 210.27.48.2 ,指明ip包中源地址是210.27.48.2 , dst net 202.0.0.0 指明目的网络地址是202.0.0.0 。如果没有指明方向关键字，则缺省是src or dst关键字。
第三种是协议的关键字，主要包括fddi,ip,arp,rarp,tcp,udp等类型。Fddi指明是在FDDI(分布式光纤数据接口网络)上的特定 的网络协议，实际上它是"ether"的别名，fddi和ether具有类似的源地址和目的地址，所以可以将fddi协议包当作ether的包进行处理和 分析。其他的几个关键字就是指明了监听的包的协议内容。如果没有指定任何协议，则tcpdump将会监听所有协议的信息包。

host、dst host、src host、gateway

net、dst net、src net：net num(网络号),net xx mask xx,net xx/len

port、dst port、src port、portrange、dst portrange、src portrange

ip proto [icmp, icmp6,igmp,igrp,pim,ah,esp,vrrp,udp,or tcp.]

其中tcp、udp、icmp为关键字需要转义(\)

ether proto(以太网协议)[ip,ip6,arp,rarp,atalk,aarp,decnet,sca,lat,mopdl, moprc,iso,stp,ipx,or netbeui.]

less、greater 好像是数据包的大小

另外还有vlan，mpls等等，反正功能很强大。

 

man example：

 

To print all packets arriving at or departing from sundown:

       tcpdump host sundown

To print traffic between helios and either hot or ace:

       tcpdump host helios and \( hot or ace \)

To print all IP packets between ace and any host except helios:

      tcpdump ip host ace and not helios

To print all traffic between local hosts and hosts at Berkeley:

      tcpdump net ucb-ether

To  print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell from  (mis-)interpreting  the parentheses):

      tcpdump ’gateway snup and (port ftp or ftp-data)’

To  print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net).

      tcpdump ip and not net localnet

To  print  the  start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.

      tcpdump ’tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet’

To print all IPv4 HTTP packets to and from port  80,  i.e.  print  only packets  that  contain  data, not, for example, SYN and FIN packets and ACK-only packets.  (IPv6 is left as an exercise for the reader.)

      tcpdump ’tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’

To print IP packets longer than 576 bytes sent through gateway snup:

      tcpdump ’gateway snup and ip[2:2] > 576’

To print IP broadcast or multicast packets that were not sent via  Ethernet broadcast or multicast:

      tcpdump ’ether[0] & 1 = 0 and ip[16] >= 224’

To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):

      tcpdump ’icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply’

 

检测局域网中各个ip地址的数据包数量并排序：

 tcpdump -n -i eth0 src net 192.168.1.0/24 and port not 22 -c 1000 |awk '{print $3}' | awk -F"." '{print $1"."$2"."$3"."$4}' |sort | uniq -c |sort -n -r  |head -20

x系列与16进制有关