使用tcpdump抓包和简单的命令

来源：互联网发布：seo推荐编辑：程序博客网时间：2024/05/16 02:06

1：安装tcpdump

yum install -y tcpdump

2:监控某一个网卡的流量

[root@dg-master ~]# tcpdump -i eth0

11:26:33.987299 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1496840:1497116, ack 937, win 141, length 276

11:26:33.987599 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 1497116, win 521, length 0

11:26:33.987840 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497116:1497392, ack 937, win 141, length 276

11:26:33.988530 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497392:1497572, ack 937, win 141, length 180

11:26:33.988814 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497572:1497752, ack 937, win 141, length 180

11:26:33.988934 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 1497572, win 519, length 0

11:26:33.989025 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497752:1498028, ack 937, win 141, length 276

11:26:33.989101 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1498028:1498208, ack 937, win 141, length 180

3：指定监控ip

tcpdump host 192.168.100.142

11:58:25.783219 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 464208, win 524, length 0

11:58:25.783475 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464208:464612, ack 261, win 141, length 404

11:58:25.784555 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464612:464776, ack 261, win 141, length 164

11:58:25.784765 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464776:464940, ack 261, win 141, length 164

11:58:25.784907 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 464776, win 522, length 0

11:58:25.78511:58:25.823012 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 477096:477372, ack 261, win 141, length 276

11:58:25.823156 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [P.], seq 261:313, ack 477096, win 522, length 52

11:58:25.823237 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [P.], seq 313:365, ack 477372, win 521, length 52

4：截取本机和指定ip的之间的通讯（和监控ip一样）

tcpdump -n -i eth0 host 192.168.100.100 and 192.168.100.142

5：监控进入本机的包

tcpdump -n -i eth0 dst 192.168.100.100

6：监控从本机出去的包

tcpdump -n -i eth0 src 192.168.100.100

7：过滤信息

使用and和or的组合

tcpdump -n -i eth0 src 192.168.100.100 or 192.168.100.142

tcpdump -n -i eth0 src 192.168.100.100 or 192.168.100.142 and port ! 22 and tcp

阅读全文

0 0