Use tcpdump in Linux

Although the man is detailed, sometimes you may not want to go to man or take notes for future use.

The basic command format is as follows: TCPDUMP [-package display format parameters] [-capture control parameters] 'filter matching condition'

Tcpdump can print the packet information that meets the filtering conditions in a certain display format. The package source can be a network interface or a file.

 

Generally, you can only type tcpdump to start packet capture. However, due to the lack of capture conditions, the desired package will be drowned in a large amount of useless data, and the control of display format parameters is missing, tcpdump only prints IP packet header information. Sometimes you need more precise capture control and more detailed packet information, so you need more parameters.

 

1. Capture Control Parameters

-S Pkt-size: minimum buffer for each package. The default value is 98. The content of the excess package is truncated.

-C count: when the count packet is captured, the capture is stopped. Otherwise, the capture is continued. Of course, you can terminate the capture through SIGINT or sigterm information.

-W file-Name: Write the captured package into the file instead of standard output for future analysis.

-R file-Name: reads the package content from the file and displays the package content to the standard output according to the filter conditions.

-C p-F-size when the-W parameter is used, when the package is written to a file, if the file is larger than the size MB, close the current file and open a new file for saving.

-F file-Match: Use the filter expression in the file

-I interface: capture specific Interfaces

-T type: the captured package is interpreted as "type". The list of supported types is put into the form of "put", "RTP", "RTCP", "RPC", "SNMP", and "TFTP...

-W file-count: number of files in the capture package

-Y dl-type: Set link layer type

-Z user

-L makes the output of TCPDUMP Buffer rows for processing in other pipelines

-E spi @ ipaddr algo: Secret used the specified information to decrypt IPSec data,AlgorithmIt can be Des-CBC, and secret is an ASCII key.

-D: displays the currently available interface 1 of the System.

-L display the link layer information of the current system and exit

 

2 Package display parameters

-X prints the package content in hexadecimal format, starting with the IP Header

-Xx includes Link Layer header information

-X takes 10 at the same time

-A is more convenient to display the package content in ASCII text, such as HTML.

-E indicates the printed link layer information of the headers.

-C

-N does not convert an IP address to a domain name

-Nn does not convert a port to a service at the same time.

-S: displays the absolute TCP sequence number instead of the relative sequence number.

-T: No printing time

-TT: print the unformatted time

-V: displays detailed information about the IP header, such as TTL, ID, and length.

 

3. Filter expression

[Protocol] [direction] [target]

Keywords

Target: host, net, port, portrange

Net 192.168.1.1/24

Portrange 1-1024

Direction: SRC, DST can be connected using or and

Protocol Designation: ether, WLAN, IP, ip6, ARP, TCP, UDP

IP proto TCP

Ip6 proto UDP

The ip6 protochain Type header contains the type header.

Others: Gateway, broadcast, less, greater, or algorithm expression

Less Length

These keywords may pass through not !, And & and or | to perform logical superposition

 

4 DPI

Attackers can access and filter data packets at any position.

The general format is: PROTO [arithmetic expression: Size] [Operator] [value].

+-*/& | <> Can be used in arithmetic expressions, for example, UDP [] & 0 xFFFF> 256.

The runtime can be ><>=! =

 

Example: TCPDUMP-X-C 10-S 300 'dst port 8080 and UDP [] & 0 xFFFF> 100'