Use tcpdump to intercept Linux server-side network data

Syntax Examples:

Tcpdump-vv-i ens3 ' ((TCP) && (host 183.239.240.48) && (port 3001)) '-C 100-w 12.cap

-I indicates a specified network device

The following strings are rules, and the rules are usually so spliced:

"  not "  "and" "or"  

Rule statements have these:

Protocol class:

arp,ip,tcp,udp,icmp

Address class:

Host: source or destination IP

DST Host: Destination IP

SRC Host: Source IP

Port: source or destination. (with DST host, src host, meaning ibid.)

NET: Specifies the network. (There is also DST net, SRC net)

Follow Kanenaga:

Less 100 means fewer than 100

Greater 100 means greater than 100

Advanced filtering:

According to the IP header:

Ip[0]>5

Packet size (2bytes) from the IP header to determine:

ip[2:2]>600

The TCP header can also take the size:

Tcp[0:2]

Block HTTP (not necessarily successful because the head length is not fixed):

0x4745 for "GET" first two letters "GE"

0x4854 to "HTTP" the first two letters "HT"

tcp[20:2]=0x4745 or tcp[20:2]=0x4854

==============================================

You can specify how many packets to grab by using the-c parameter, and then use "-w" to place a text file

Reference article:

Https://www.wains.be/pub/networking/tcpdump_advanced_filters.txt (Chinese translation: http://www.veryarm.com/1751.html#12)

http://packetpushers.net/masterclass-tcpdump-expressions/

https://www.hugeserver.com/kb/install-use-tcpdump-capture-packets/

Https://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html

Use tcpdump to intercept Linux server-side network data