Use of tcpdump, the latest Linux packet capture tool
System
Centos6.5
Procedure
- The default system does not follow tcpdump and cannot be used directly. Therefore, you need to install
Installation command: yum install-y tcpdump
- Generally, our server has only one Nic, and tcpdump can be used to capture data packets directly. However, it is too troublesome, so we will add parameters for obtaining.
For example, intercept data between the host (192.168.30.122) and host 120.110.111.101.
Tcpdump-n-I eth0 host 192.168.30.122 and 120.110.111.101
- The following format can be used to intercept all data on the server:
Tcpdump-n-I eth0 dst 192.168.30.122
Or the server has multiple ip addresses that can use parameters.
Tcpdump-n-I eth0 dst 192.168.30.122 or 192.168.30.120
The following format is used to capture all TCP packets entering the server. For details, refer
Tcpdump-n-I eth0 dst 192.168.31.147 or 192.168.31.157 and tcp
Data packets from the Local Machine
Tcpdump-n-I eth0 src 192.168.31.147 or 192.168.31.157
Tcpdump-n-I eth0 src 192.168.31.147 or 192.168.31.157 and port! 22 and tcp
