Tcpdump: Filter a port

Tcpdump is used to filter a port. Generally, Tcpdump is used when we use tcpdump: Java code tcpdump-I ethx www.2cto.com. The command below is to view the access volume of port 80 and sort it, take the first 20 pieces of Java code tcpdump-I eth0-tnn dst port 80-c 1000 | awk-F ". "'{print $1 ". "$2 ". "$3 ". "$4} '| sort | uniq-c | sort-nr | head-20: filter out the Java code tcpdump-I eth1-s 1500 port not 22 tcpdump-I eth1- s 1500 port not 22 and port not 53 tcpdump-I eth1 port not 22 and host 1.2.3.4 www.2cto.com II. detailed usage of tcpdump The first type keyword mainly includes host, net, port, for example host 210.27.48.2. It indicates that 210.27.48.2 is a host, and net 202.0.0.0 indicates that 202.0.0.0 is a network address, port 23 indicates that the port number is 23. If no type is specified, the default type is host. the second type is the key words for determining the transmission direction, including src, dst, dst or src, dst and src, which indicate the transmission direction. For example, src 210.27.48.2 indicates that the source address in the IP package is 210.27.48.2, and dst net 202.0.0.0 indicates that the destination network address is 202.0.0.0. If no direction keyword is specified, the src or dst keyword is used by default. The third type is the protocol keyword, which mainly includes fddi, ip, arp, rarp, tcp, udp, and other types. Fddi indicates that it is in FDDI (Distributed Optical Fiber Data Interface Network ?? The specific network protocol is actually an alias for "ether". fddi and ether have similar source and destination addresses, therefore, the fddi protocol package can be processed and analyzed as the ether package. The other keywords indicate the Protocol content of the listener package. If no protocol is specified, tcpdump listens to the information packages of all protocols. In addition to these three types of keywords, other important keywords include gateway, broadcast, less, greater, and three logical operations. The non-operation type is 'not ''! ', And the operation is 'and',' & '; or the operation is 'or',' │ '; these keywords can be combined to form a powerful combination condition to meet people's needs. The following are several examples. Under normal circumstances, directly starting tcpdump will monitor all the data packets flowing through the first network interface. # Tcpdump: listening on fxp0 11:58:47. 873028 202.102.245.40.netbios-ns> 202.102.245.127.netbios-ns: udp 50 11:58:47. 974331 0: 10: 7b: 8: 3a: 56> 1: 80: c2: 0: 0: 0 802.1d ui/C len = 43 0000 0000 0080 0000 1007 cf08 0900 0000 0e80 0000 902b 4695 0980 8701 0014 0002 000f 0000 902b 4695 0008 00 11:58:48. 373134 0: 0: e8: 5b: 6d: 85> Broadcast sap e0 ui/C len = 97 ffff 0060 0004 ffff 0452 f Fff ffff 0000 e85b 6d85 4008 0002 0640 4d41 5354 4552 5f57 4542 0000 0000 0000 00 use the-I parameter to specify the network interface of the tcpdump listener, which is very useful when the computer has multiple network interfaces, use the-c parameter to specify the number of data packets to be monitored, use the-w parameter to specify to write the listening data packet to the file and save all the packets received and sent by A to intercept all 210.27.48.1 hosts: # tcpdump host 210.27.48.1 B wants to intercept the communication between host 210.27.48.1 and host 210.27.48.2 or later. Use the command: (when brackets are applied in the command line, be sure to # tcpdump host 210.27.48.1 and) C If You Want To obtain the host 210.27.48.1 except for the host 210.27.48.2 Run the command: # tcpdump ip host 210.27.48.1 and! 210.27.48.2 D if you want to obtain the telnet packet received or sent by the host 210.27.48.1, run the following command: # tcpdump tcp port 23 host 210.27.48.1 E monitor udp port 123 on the local machine 123 as the ntp service port # tcpdump udp port 123 F system only performs communication packets on the host named hostname monitoring. The host name can be a local host or any computer on the network. The following command can read all data sent by the host hostname: # tcpdump-I eth0 src host hostname G the following command can monitor all data packets sent to the host hostname: # tcpdump-I eth0 dst host hostname H We can also monitor data packets through the specified Gateway: # tcpdump-I eth0 gateway Gatewayname I if you want to monitor the TCP or UDP data packets destined for the specified port, run the following command: # tcpdump-I eth0 host hostname and port 80 J If You Want To obtain an ip packet for all hosts except 210.27.48.1 and 210.27.48.2, run the following command: # tcpdump ip host 210.27.48.1 and! 210.27.48.2 K to intercept the communication between the host 210.27.48.1 and host 210.27.48.2 or 210.27.48.3, run the following command: (when brackets are applied in the command line, be sure to # tcpdump host 210.27.48.1 and) L if you want to obtain the ip packet for all hosts except 210.27.48.1 and 210.27.48.2, run the command: # tcpdump ip host 210.27.48.1 and! 210.27.48.2 M to obtain the telnet packet received or sent by the host 210.27.48.1, run the following command: # tcpdump tcp port 23 host 210.27.48.1 the third is the protocol keyword, which mainly includes fddi, ip, arp, in addition to the three types of keywords, such as rarp, tcp, and udp, other important keywords are as follows: gateway, broadcast, less, greater, and three logical operations, the non-operation is 'not ''! ', And the operation is 'and',' & '; or the operation is 'o R',' | '; the second is the keyword for determining the transmission direction, mainly including src, dst, dst or src, dst and src. If we only need to list the data packets sent to port 80, use dst port. If we only want to see the data packets returned from port 80, use src port. # Tcpdump-I eth0 host hostname and dst port 80 the destination port is 80 or # tcpdump-I eth0 host hostname and src port 80 the source port is 80 and generally the host that provides http services if if there are many conditions, add and or not # tcpdump-I eth0 host before the condition! 211.161.223.70 and! 211.161.223.71 and dst port 80 if you use a hybrid mode system on ethernet, logs will be recorded at May 7 20:03:46 localhost kernel: eth0: Promiscuous mode enabled. may 7 20:03:46 localhost kernel: device eth0 entered promiscuous mode May 7 20:03:57 localhost kernel: device eth0 left promiscuous mode tcpdump does not thoroughly decode the intercepted data, most of the content in the data packet is printed directly in hexadecimal format. Obviously, this is not conducive to the analysis of network faults. The common solution is to first use tcpdump with the-w parameter to capture data and save it to the file, and then use other programs for decoding and analysis. Of course, filter rules should also be defined to prevent the captured data packets from filling the entire hard disk. In addition to the filter statement, there is also a very important parameter. That is to say, if this parameter is not set correctly, packet data will be lost! It is the-s parameter, snaplen, that is, the interception length of the data packet. man will understand it carefully! The intercepted length is 60 bytes by default, but generally the ethernet MTU is 1500 bytes. Therefore, when you want to capture packets larger than 60 bytes, using the default parameters will cause packet data loss! You only need to use-s 0 to capture data by the package length!