tcpdump(Linux下面的抓包工具)支持针对网络层,协议,主机,端口的过滤并提供and,or,not等逻辑语句筛选有用信息。如下面示例,抓取web服务器(80端口)接收到的前三个请求包并打印成16进制与ASCII文本内容。
常用的参数:
-i 指定网络设备
dst/src 目的/源
host/port 主机/端口
-c 抓包数目
-s 抓包长度(0为自动适配)
-X 十六进制打印
...
vm6245:~ # tcpdump -i eth0 dst host 10.6.2.245 and src 10.6.2.11 and port 80 -X -s 0 -c 3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 16:48:42.273366 IP 192.168.197.118.20038 > 10.6.2.245.http: S 1455277500:1455277500(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK> 0x0000: 4500 0034 15ca 4000 7f06 52e0 c0a8 c576 [email protected] 0x0010: 0a06 02f5 4e46 0050 56bd c5bc 0000 0000 ....NF.PV....... 0x0020: 8002 2000 50ec 0000 0204 05b4 0103 0302 ....P........... 0x0030: 0101 0402 .... 16:48:42.273836 IP 192.168.197.118.20038 > 10.6.2.245.http: . ack 1726625741 win 16425 0x0000: 4500 0028 15cb 4000 7f06 52eb c0a8 c576 E..([email protected] 0x0010: 0a06 02f5 4e46 0050 56bd c5bd 66ea 37cd ....NF.PV...f.7. 0x0020: 5010 4029 d2c8 0000 P.@).... 16:48:42.274379 IP 192.168.197.118.20038 > 10.6.2.245.http: P 0:376(376) ack 1 win 16425 0x0000: 4500 01a0 15cc 4000 7f06 5172 c0a8 c576 [email protected] 0x0010: 0a06 02f5 4e46 0050 56bd c5bd 66ea 37cd ....NF.PV...f.7. 0x0020: 5018 4029 a912 0000 4745 5420 2f20 4854 P.@)....GET./.HT 0x0030: 5450 2f31 2e31 0d0a 486f 7374 3a20 3130 TP/1.1..Host:.10 0x0040: 2e36 2e32 2e32 3435 0d0a 5573 6572 2d41 .6.2.245..User-A 0x0050: 6765 6e74 3a20 4d6f 7a69 6c6c 612f 352e gent:.Mozilla/5. 0x0060: 3020 2857 696e 646f 7773 204e 5420 362e 0.(Windows.NT.6. 0x0070: 313b 2072 763a 3133 2e30 2920 4765 636b 1;.rv:13.0).Geck 0x0080: 6f2f 3230 3130 3031 3031 2046 6972 6566 o/20100101.Firef 0x0090: 6f78 2f31 332e 302e 310d 0a41 6363 6570 ox/13.0.1..Accep 0x00a0: 743a 2074 6578 742f 6874 6d6c 2c61 7070 t:.text/html,app 0x00b0: 6c69 6361 7469 6f6e 2f78 6874 6d6c 2b78 lication/xhtml+x 0x00c0: 6d6c 2c61 7070 6c69 6361 7469 6f6e 2f78 ml,application/x 0x00d0: 6d6c 3b71 3d30 2e39 2c2a 2f2a 3b71 3d30 ml;q=0.9,*/*;q=0 0x00e0: 2e38 0d0a 4163 6365 7074 2d4c 616e 6775 .8..Accept-Langu 0x00f0: 6167 653a 207a 682d 636e 2c7a 683b 713d age:.zh-cn,zh;q= 0x0100: 302e 382c 656e 2d75 733b 713d 302e 352c 0.8,en-us;q=0.5, 0x0110: 656e 3b71 3d30 2e33 0d0a 4163 6365 7074 en;q=0.3..Accept 0x0120: 2d45 6e63 6f64 696e 673a 2067 7a69 702c -Encoding:.gzip, 0x0130: 2064 6566 6c61 7465 0d0a 436f 6e6e 6563 .deflate..Connec 0x0140: 7469 6f6e 3a20 6b65 6570 2d61 6c69 7665 tion:.keep-alive 0x0150: 0d0a 4966 2d4d 6f64 6966 6965 642d 5369 ..If-Modified-Si 0x0160: 6e63 653a 2054 7565 2c20 3234 204a 756c nce:.Tue,.24.Jul 0x0170: 2032 3031 3220 3036 3a34 393a 3034 2047 .2012.06:49:04.G 0x0180: 4d54 0d0a 4361 6368 652d 436f 6e74 726f MT..Cache-Contro 0x0190: 6c3a 206d 6178 2d61 6765 3d30 0d0a 0d0a l:.max-age=0.... 3 packets captured 6 packets received by filter 0 packets dropped by kernel还可以添加-w参数将抓包结果保存为本地文件,-r参数可以读取保存结果,-D可以打印本地网络设备信息。
iperf用于网络测速,需要双方都安装iperf工具
vm6245:~ # iperf -s ------------------------------------------------------------ Server listening on TCP port 5001 TCP window size: 85.3 KByte (default) ------------------------------------------------------------ [ 4] local 10.6.2.245 port 5001 connected with 10.6.2.245 port 46358 [ ID] Interval Transfer Bandwidth [ 4] 0.0-30.0 sec 27.9 GBytes 8.00 Gbits/sec客户端测速方法
vm6245:~ # iperf -c 10.6.2.245 -t 30 -i 2 ------------------------------------------------------------ Client connecting to 10.6.2.245, TCP port 5001 TCP window size: 128 KByte (default) ------------------------------------------------------------ [ 3] local 10.6.2.245 port 46358 connected with 10.6.2.245 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0- 2.0 sec 1.91 GBytes 8.18 Gbits/sec [ 3] 2.0- 4.0 sec 1.77 GBytes 7.60 Gbits/sec [ 3] 4.0- 6.0 sec 1.77 GBytes 7.60 Gbits/sec [ 3] 6.0- 8.0 sec 1.77 GBytes 7.61 Gbits/sec [ 3] 8.0-10.0 sec 1.77 GBytes 7.61 Gbits/sec [ 3] 10.0-12.0 sec 1.77 GBytes 7.61 Gbits/sec [ 3] 12.0-14.0 sec 1.77 GBytes 7.61 Gbits/sec [ 3] 14.0-16.0 sec 1.77 GBytes 7.62 Gbits/sec [ 3] 16.0-18.0 sec 1.77 GBytes 7.62 Gbits/sec [ 3] 18.0-20.0 sec 1.77 GBytes 7.62 Gbits/sec [ 3] 20.0-22.0 sec 1.77 GBytes 7.61 Gbits/sec [ 3] 22.0-24.0 sec 1.77 GBytes 7.60 Gbits/sec [ 3] 24.0-26.0 sec 1.77 GBytes 7.60 Gbits/sec [ 3] 26.0-28.0 sec 1.77 GBytes 7.61 Gbits/sec [ 3] 28.0-30.0 sec 2.99 GBytes 12.8 Gbits/sec [ 3] 0.0-30.0 sec 27.9 GBytes 8.00 Gbits/sec上面参数的意义是30秒钟,每2秒测速一次,由于我是测的本机,所以测速结果未免夸张了点,呵呵