Detailed usage of tcpdump

The F system only monitors the communication data packets of the host named hostname. The host name can be a local host or any computer on the network. The following command reads all the data sent by the host hostname: # The Command below the tcpdump-ieth0srchosthostnameG can monitor all the packets sent to the host hostname :#

The F system only monitors the communication data packets of the host named hostname. The host name can be a local host or any computer on the network. The following command reads all data sent by the host hostname:

#Tcpdump-I eth0 src host hostname

The command below G can monitor all data packets sent to the host hostname:

# Tcpdump-I eth0 dst host hostname

H we can also monitor the data packets through the specified Gateway:

# Tcpdump-I eth0 gateway Gatewayname

If you want to monitor the TCP or UDP data packets destined for the specified port, run the following command:

# Tcpdump-I eth0 host hostname and port 80

J. if you want to obtain an IP packet for all hosts except 210.27.48.1 and 210.27.48.2

, Run the following command:

# Tcpdump ip host 210.27.48.1 and! 210.27.48.2

K. to intercept the communication between host 210.27.48.1 and host 210.27.48.2 or 210.27.48.3, run the following command:

:

# Tcpdump host 210.27.48.1 and \ (210.27.48.2 or 210.27.48.3 \)

L If you want to obtain an IP packet for all hosts except 210.27.48.1 and 210.27.48.2, run the following command:

# Tcpdump ip host 210.27.48.1 and! 210.27.48.2

M to obtain the telnet packet received or sent by the host 210.27.48.1, run the following command:

# Tcpdump tcp port 23 host 210.27.48.1

The third type is the protocol keyword, which mainly includes fddi, ip, arp, rarp, tcp, udp, and other types.

In addition to the three types of keywords, other important keywords are as follows: gateway, broadcast, less,

Greater, there are three logical operations. The non-operation is 'not ''! ', And the operation is 'and',' & '; or the operation is 'o

R', '| ';

The second type is the key words for determining the transmission direction, including src, dst, dst or src, dst and src,

If we only need to list the data packets sent to port 80, use dst port; if we only want to see the data packets returned to port 80, use srcport.

# Tcpdump Ci eth0 host hostname and dst port 80 the destination port is 80

Or

# Tcpdump Ci eth0 host hostname and src port 80 the source port is 80. generally, it is the host that provides http services.

If there are many conditions, add and or not before the conditions.

# Tcpdump-I eth0 host! 211.161.223.70 and! 211.161.223.71and dst port 80

Logs in the ethernet mixed mode system are recorded.

May 7 20:03:46 localhost kernel: eth0: Promiscuous modeenabled.

May 7 20:03:46 localhost kernel: device eth0 enteredpromiscuous mode

May 7 20:03:57 localhost kernel: device eth0 left promiscuousmode

Tcpdump does not thoroughly decode the intercepted data. most of the content in the data packet is printed in hexadecimal format. Obviously, this is not conducive to the analysis of network faults. The common solution is to first use tcpdump with The-w parameter to capture data and save it to the file, and then use other programs for decoding and analysis. Of course, filter rules should also be defined to prevent the captured data packets from filling the entire hard disk.

[1] [2]