Linux-tcpdump command

In Linux, tcpdump is usually used to capture network packets. You can use Wireshark to open the Analysis Network Package. When using tcpdump, you generally need to use the root user.

By default, no parameters are included:Start directlyTcpdumpAll data packets flowing through the first network interface will be monitored.

 
Tcpdump
 

Specify the NIC for packet capture:If no Nic is specified, the default tcpdump only monitors the first network interface, which is usually eth0. In the following example, no network interface is specified.

 
Tcpdump-I eth0
 

Specify the host to capture packets:

 
Tcpdump host 210.27.48.1
 

Intercept all data packets sent by host hostname:

 
Tcpdump-I eth0 SRC host 210.27.48.1
 

InterceptionAll sent to hostHostnamePacket:

Tcpdump-I eth0 DST host 210.27.48.2
 

Intercept data packets from the specified host and Port:

 
Tcpdump TCP port 9843 host 210.27.48.2
 

Tcpdump and Wireshark

Wireshark (previously Ethereal) is an easy-to-use packet capture tool in windows. However, in Linux, it is difficult to find a good graphical packet capture tool.Fortunately, tcpdump is available. We can use tcpdump
+ The Perfect Combination of Wireshark: capture packets in Linux and analyze packets in windows.

 
Tcpdump TCP-I eth1-t-s 0-C 100 and DST port! 22 and SRC net 192.168.1.0/24-W./target. Cap
 

(1) TCP: ip icmp arp rarp, TCP, UDP, ICMP, and other options must be placed at the first parameter to filter the datagram type.
(2)-I eth1: only capture packets passing through the eth1 Interface
(3)-T: do not display the timestamp
(4)-S 0: The capture length is 68 bytes by default during packet capture. After-S 0 is added, the complete data packet can be captured.
(5)-C 100: only capture 100 packets
(6) DST port! 22: do not capture data packets whose destination port is 22
(7) SRC net 192.168.1.0/24: The Source network address of the packet is 192.168.1.0/24.
(8)-W./target. Cap: Save it as a cap file for convenient analysis using Ethereal (Wireshark)

Capture HTTP packets using tcpdump

 
Tcpdump-xvvennss 0-I eth0 TCP [20:2] = 0x4745 or TCP [20:2] = 0x4854
 

0x4745 is the first two letters of "get" "Ge ",0x4854 is the first two letters of "HTTP" "ht ".

Tcpdump does not thoroughly decode the intercepted data. Most of the content in the data packet is printed in hexadecimal format. Obviously, this is not conducive to the analysis of network faults. The common solution is to first use tcpdump with the-W parameter to capture data and save it to the file, and then use otherProgram(Such as Wireshark) for decoding analysis. Of course, filter rules should also be defined to prevent the captured data packets from filling the entire hard disk.