Tcpdump is a basic tool for network protocol analysis. Tshark is the command line version of wireshark (formerly known as ethereal), a well-known open-source network protocol analysis tool. wireshark can decode and analyze thousands of network protocols. Wireshark and tcpdump both use the libpcap library (see the libpcap programming tutorial) for network packet capture. TCPDUMP details Tcpdump is a basic tool for network protocol analysis. Tshark is the command line version of wireshark (formerly known as ethereal), a well-known open-source network protocol analysis tool. wireshark can decode and analyze thousands of network protocols. Wireshark and
TcpdumpAll use the libpcap library (see the libpcap programming tutorial) for network packet capture.
TCPDUMP
For more information about manpage, see tcpdump.
Basic usage
The parameters of Tcpdump are divided into two parts: options and filter_expression ).
# Tcpdump [options] [filter_expression]
For example
# Tcpdump-c 100-I eth0-w log tcp dst port 50000
Some options parameters are as follows:
-C 100: Number of intercepted packages
-I eth0 indicates the network port to listen
-W log output to the file named log (libpcap format)
The filter_expression parameter is tcp dst port 50000, which only listens to tcp packets whose target port is 50000.
More examples:
/* The monitored destination address is traffic other than the intranet address (192.168.3.1-192.168.3.254 */
# Tcpdump dst net not 192.168.3.0/24
/*
Monitor traffic except HTTP browsing (Port 80/8080), SSH (22), and POP3 (110). Note that the escape character \ is added in brackets (before \, -n and-nn are explained later.
*/
# Tcpdump-n-nn port not \ (www.or 22 or 110 \)
Or
# Tcpdump-n-nn port! \ (Www or 22/110 \)
/* The MAC address of the monitoring source host is 00: 50: 04: BA: 9B */
# Tcpdump ether src 00: 50: 04: BA: 9B
/* Monitor the source host as 192.168.0.1 and the destination port is not a telnet package */
# Tcpdump src host 192.168.0.1 and dst port not telnet
Ip icmp arp rarp, tcp, udp, icmp, and other options must be placed at the first parameter to filter the data type. For example:
# Tcpdump ip src ...... // Only filter data-IP headers on the link layer
# Tcpdump udp and src host 192.168.0.1 // only filter all udp headers of the source host 192.168.0.1
TcpDump provides many options parameters for us to choose how to process the data, as shown below:
-L redirects data. For example, tcpdump-l> tcpcap.txt stores the obtained data in the tcpcap.txt file.
-N does not convert the IP address to the host name. If you do not use this option, TcpDump will convert the IP address to the host name display when a host's host name exists in the system, just like this: eth0 <ntc9.1165> router.domain.net. telnet: eth0 <192.168.0.9.1165> 192.168.0.1.telnet.
-Nn does not convert the port name. After using-nn, the above information becomes: eth0 <ntc9.1165> router.domain.net. 23.
-N does not print the default domain name. After N, it is eth0 <ntc9.1165> router. telnet.
-O does not optimize the matching code.
-T does not print the UNIX timestamp, that is, the time is not displayed.
-Tt prints the original, unformatted time.
-V has a more detailed output than a common TTL and service type.
Parameter details
Tcpdump adopts the command line method. its command format is:
Tcpdump [-adeflnNOpqStvx] [-c quantity] [-F file name]
[-I network interface] [-r file name] [-s snaplen]
[-T type] [-w file name] [expression]
-A converts a network address and broadcast address into a name;
-D. give the code that matches the information package in an assembly format that people can understand;
-Dd provides the code that matches the information package in the format of the C program segment;
-Ddd provides the matching information package code in decimal format;
-E prints the header information of the data link layer in the output line;
-F print the Internet address in numbers;
-L changes the standard output to the buffer row format;
-N does not convert the network address into a name;
-T no timestamp is printed on each output line;
-V outputs a slightly detailed information. for example, the IP package can contain ttl and service type information;
-Vv: output detailed message information;
-C. after receiving the specified number of packages, tcpdump stops;
-F read the expression from the specified file and ignore other expressions;
-I indicates the network interface of the listener;
-R reads packets from a specified file (these packets are generally generated using the-w option );
-W directly writes the package into the file and does not analyze or print it out;
-T directly interpret the packet to be listened to as a specified type of message. Common types include rpc (remote process
Call) and snmp (Simple Network Management Protocol ;)
Introduction to tcpdump expressions
A regular expression is used by tcpdump to filter packets.
The packet will be captured. If no conditions are provided, all information packages on the network will
Intercepted.
In an expression, the following types of keywords are generally used. one is about the types of keywords, including host,
Net, port, for example, host 210.27.48.2, indicating that 210.27.48.2 is a host, and net 202.0.0.0 indicates
202.0.0.0 is a network address and port 23 indicates that the port number is 23. If no type is specified, the default type is
Host.
The second type is the key words for determining the transmission direction, including src, dst, dst or src, dst and src,
These keywords indicate the transmission direction. For example, src 210.27.48.2 indicates that the source address in the IP package is 210.27.
48.2, dst net 202.0.0.0 indicates that the destination network address is 202.0.0.0. If no direction keyword is specified
The default value is the src or dst keyword.
The third type is the protocol keyword, which mainly includes fddi, ip, arp, rarp, tcp, udp, and other types. Fddi indicates that
The specific network protocol on FDDI (distributed optical fiber data interface network) is actually the alias of "ether", fddi and e
Ther has a similar source address and destination address, so you can use the fddi protocol package as the ether package for processing and analysis.
The other keywords indicate the protocol content of the listener package. If no protocol is specified, tcpdump will
Listen to the information packages of all protocols.
In addition to the three types of keywords, other important keywords are as follows: gateway, broadcast, less,
Greater, there are three logical operations. The non-operation is 'not ''! ', And the operation is 'and',' & '; or the operation is 'o
R', '| ';
These keywords can be combined to form a powerful combination condition to meet people's needs. The following are several examples:
Description.
(1) all packets received and sent by all hosts 210.27.48.1 are to be intercepted:
# Tcpdump host 210.27.48.1
(2) to intercept the communication between host 210.27.48.1 and host 210.27.48.2 or 210.27.48.3, run the following command:
(When using parentheses in the command line, be sure
# Tcpdump host 210.27.48.1 and \ (210.27.48.2 or 210.27.48.3 \)
(3) If you want to obtain an IP packet for all hosts except 210.27.48.1 and 210.27.48.2
, Run the following command:
# Tcpdump ip host 210.27.48.1 and! 210.27.48.2
(4) to obtain the telnet packet received or sent by the host 210.27.48.1, run the following command:
# Tcpdump tcp port 23 host 210.27.48.1
Introduction to output results of tcpdump
Below we will introduce the output information of several typical tcpdump commands.
(1) data link layer header information
Run the command # tcpdump -- e host ice
Ice is a linux host. her MAC address is 0: 90: 27: 58: AF: 1A.
H219 is a SUN workstation with SOLARIC installed. its MAC address is 8: 0: 20: 79: 5B: 46; the previous one
Command output is as follows:
21:50:12. 847509 eth0 <8: 0: 20: 79: 5b: 46 0: 90: 27: 58: af: 1a ip 60: h219.33357> ice.
Telne
T 0: 0 (0) ack 22535 win 8760 (DF)
Analysis: 21: 50: 12 indicates the display time, 847509 indicates the ID number, and eth0 indicates the display time. <表示从网络接口eth0 接受该
The packet. eth0> indicates that the packet is sent from the network interface device. 8: 0: 20: 79: 5b: 46 is the MAC address of the host H219.
Indicates that the data packet is sent from the source address H219. 0: 90: 27: 58: af: 1a is the MAC address of the host ICE, indicating
The destination address is ICE. ip indicates that the data packet is an IP packet, 60 indicates the length of the data packet, and h219.33357> ice.
Telnet indicates that the packet is sent from Port 33357 of host H219 to port. ack 22535 of TELNET (23) of host ICE
Indicates to respond to a packet whose serial number is 222535. win 8760 indicates that the size of the sending window is 8760.
(2) TCPDUMP output information of ARP packets
Run the command # tcpdump arp
The output result is:
22:32:42. 802509 eth0> arp who-has route tell ice (0: 90: 27: 58: af: 1a)
22:32:42. 802902 eth0 <arp reply route is-at 0: 90: 27: 12: 10: 66 (0: 90: 27: 58: af
: 1a)
Analysis: 22:32:42 is the timestamp, 802509 is the ID number, eth0> indicates that the packet is sent from the host, arp indicates that the packet is
ARP Request packet. who-has route tell ice indicates the MAC address of the host's ROUTE request by the host ICE. 0: 90: 27: 5
8: af: 1a is the MAC address of the host ICE.
(3) TCP packet output information
The common output information of TCP packets captured with TCPDUMP is:
Src> dst: flags data-seqno ack window urgent options
Src> dst: Indicates from the source address to the destination address. flags indicates the flag information in the TCP packet, S indicates the SYN mark, and F (F
IN), P (PUSH), R (RST) "." (not marked); data-seqno is the sequence number of data IN the data packet, and ack is
The sequence number expected next time. window indicates the size of the window that receives the cache. urgent indicates whether there is an emergency pointer in the data packet.
Options is an option.
(4) UDP packet output information
The general output information of the UDP packet captured with TCPDUMP is:
Route. port1> ice. port2: udp lenth
UDP is very simple. the output line above indicates a UDP packet sent from the port1 port of the host ROUTE to the port2 port of the host ICE. the type is UDP and the package length is lenth.
Tshark
For detailed parameters, see tshark manpage.
// List network interfaces that can listen for traffic. Tshark uses numbers such as 1, 2,... to identify eth0, eth1...
# Tshark-D
// Traffic of UDP port 1234 on the listening interface eth0
# Tshark-f "udp port 1234"-I 1
Tshark's strength lies in its complete decoding of the protocol, and even re-decoding the slice TCP packet, such
// Listen to the http traffic of port 80 on the eth0 interface, and print the host and location of the http request header
# Tshark-f "dst port 80"-T fields-e http. host-e http. location-I 1
The-f parameter specifies the filtering expression (equivalent to the filter_expression of tcpdump)
-T fields specifies that the screen output information type is the specified protocol field (use-e to add the specified field), which is only supported in versions 0.99.6 and later of wireshark.
-I 1 indicates that the network interface of the specified listener is No. 1.
// Listen for http traffic, only GET requests are filtered, listen for 10 seconds, print the http host and URL
C: \ Program Files \ Wireshark \ tshark.exe-I 4-n-f "tcp [(tcp [12:1] & 0xf0)> 2 ): 4] = 0x47455420 "-T fields-e http. host-ehttp. request. uri-a duration: 10
