tcpdump的使用方法

ftp抓包命令的使用

tcpdump的语法：

tcpdump [options] [Protocol] [Direction] [Host(s)] [Value] [Logical Operations] [Other expression]

Protocol(协议):

Values(取值): ether, fddi, ip, arp, rarp, decnet, lat, sca, moprc, mopdl, tcp and udp.

If no protocol is specified, all the protocols are used.

Direction(流向):

Values(取值): src, dst, src and dst, src or dst

If no source or destination is specified, the "src or dst" keywords are applied. (默认是src or dst)

For example, "host 10.2.2.2" is equivalent to "src or dst host 10.2.2.2".

Host(s)(主机):

Values(替代关键字): net, port, host, portrange.

If no host(s) is specified, the "host" keyword is used. 默认如果此段没有指定关键字，默认即host。

For example, "src 10.1.1.1" is equivalent to "src host 10.1.1.1".

Logical Operations:

(1) AND

and or &&

(2) OR

or or ||

(3) EXCEPT

not or !

常用选项：

-i any : Listen on all interfaces just to see if you're seeing any traffic.

 //指定网卡接口，表示在哪个网卡接口上捕获的

-n : Don't resolve hostnames.//不反解主机名

-nn : Don't resolve hostnames or port names.

//即不反解主机名称，又不反解端口名称

-X : Show the packet's contents in both hex and ASCII.

//抓到的报文，显示16进制和ASCII的报文

-XX : Same as -X, but also shows the ethernet header.

//显示以太网首部，比-X显示的信息更多

-v, -vv, -vvv : Increase the amount of packet information you get back.

//显示详细信息

-c # : Only get x number of packets and then stop.

//表示只抓#个包后就停止

-s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.

-S : Print absolute sequence numbers. //显示绝对的报文序列号

-e : Get the ethernet header as well. //抓取以太网首部

-q : Show less protocol information. //显示相关协议信息

-E : Decrypt IPSEC traffic by providing an encryption key.

-A ：Display Captured Packets in ASCII

-w /path/to/some_file : Capture the packets and write into a file

//把捕获的报文保存到某文件中

-r /path/from/some_file : Reading the packets from a saved file

-tttt : Capture packets with proper readable timestamp

eg:[root@ns ~]# tcpdump -i eth0 -nn -X tcp port 21 and host 172.16.7.1