Tcpdump very practical example of grasping a bag

Detailed documentation see TCPDUMP advanced Filtration Tips

Basic Grammar ========
Filter Host
--------
-Crawl all network data through eth1, destination or source address is 192.168.1.1
# tcpdump-i ETH1 Host 192.168.1.1
-Source Address
# tcpdump-i eth1 src host 192.168.1.1
-Destination Address
# tcpdump-i eth1 DST host 192.168.1.1
Filter port
--------
-Crawl all network data through eth1, destination or source port is 25
# tcpdump-i Eth1 Port 25
-Source Port
# tcpdump-i eth1 Src port 25
-Destination Port
# tcpdump-i ETH1 DST port 25 network filtering
--------
# tcpdump-i eth1 Net 192.168
# tcpdump-i eth1 src net 192.168
# tcpdump-i eth1 DST Net 192.168
Protocol filtering
--------
# tcpdump-i eth1 ARP
# tcpdump-i eth1 IP
# tcpdump-i Eth1 TCP
# tcpdump-i eth1 UDP
# tcpdump-i eth1 ICMP
Common expressions
----------
Non -:! or "not" (remove double quotes)
And: && or "and"
Or: | | or "or"
-Crawl all TCP data that has passed through eth1, the destination address is 192.168.1.254 or 192.168.1.200 port is 80
# tcpdump-i eth1 ' ((TCP) and (port) and (DST host 192.168.1.254) or (DST host
192.168.1.200))) '
-Crawl all ICMP data that has passed through eth1, the target MAC address is 00:01:02:03:04:05
# tcpdump-i eth1 ' ((ICMP) and (Ether DST host 00:01:02:03:04:05)) '
-Crawl all through eth1, the destination network is 192.168, but the destination host is not 192.168.1.200 TCP data

# tcpdump-i eth1 ' ((TCP) and ((DST net 192.168) and (not DST host 192.168.1.200)) '

-Just grab the SYN bag.
# tcpdump-i eth1 ' tcp[tcpflags] = Tcp-syn '
-Grab SYN, ACK
# tcpdump-i eth1 ' tcp[tcpflags] & Tcp-syn!= 0 and Tcp[tcpflags] & tcp-ack!= 0 '
Grasping SMTP data
----------
# tcpdump-i Eth1 ' ((port) and (tcp[(TCP[12]>>2): 4] = 0x4d41494c)) '
Grab the data area started as "Mail" package, "mail" hexadecimal is 0x4d41494c.
Catching HTTP Get Data
--------------
# tcpdump-i eth1 ' tcp[(TCP[12]>>2): 4] = 0x47455420 '
The hexadecimal of "get" is 47455420
Grab SSH back
---------
# tcpdump-i eth1 ' tcp[(TCP[12]>>2): 4] = 0x5353482d '
The hexadecimal of "ssh-" is 0x5353482d

# tcpdump-i eth1 ' (tcp[(TCP[12]>>2): 4] = 0x5353482d) and (tcp[((tcp[12]>>2) +4): 2]
= 0x312e) ' Capture the old version of SSH return information, such as "SSH-1.99 ..."

-Grab DNS Request data
# tcpdump-i eth1 UDP DST Port 53
Other
----
-C parameter is also more common for operators, because the traffic is relatively large server, by artificial ctrl + C or
Catch too much, so you can use the-c parameter to specify how many packets to grab.
# time Tcpdump-nn-i eth0 ' tcp[tcpflags] = Tcp-syn '-C 10000 >/dev/null
The above command calculates how much time it takes to grab 10,000 SYN packets, and you can tell what the traffic is likely to be.

Real-time grab a GET packet of port number 8000 and write to GET.log

Tcpdump-i eth0 ' (Port 8000) and (tcp[(tcp[12]>>2): 4]=0x47455420)) '-nnal-w/tmp/get.log

--------

-W directly writes the package to the file and does not parse and print it;
Tcpdump-i eth1-w/tmp/xxx.cap--------

The official room for-X is:
"When parsing and printing, print the header of each packet, print hexadecimal and ASCII data, each packet (minus its link layer header)"
To be blunt, the data message is printed in hexadecimal, but the header of the Ethernet is not displayed, only the content of the IP layer is displayed.
-s scratch length, generally set to 0, that is 65535 bytes

Example: Tcpdump-i eth1 port 11340 and SRC host 180.168.210.xx-x-s0