In Linux, the network protocol analysis tool-tcpdump Quick Start manual-Linux Enterprise Application-Linux server application information. For more information, see the following.
About TCPDUMP
In traditional network analysis and testing technologies, sniffer is the most common and important technology. Sniffer tool first
Designed for network analysis by network administrators and network programmers. Network administrators can use the sniffer tool to keep abreast of the problem.
When the network performance drops sharply, you can use the sniffer tool to analyze the cause and find out the cause of network congestion.
Source. For Network programmers, the sniffer tool is used to debug programs.
Friends who have used sniffer tools on windows (such as netxray and sniffer pro) may know that
In the network, the sniffer tool can be used to view all the traffic in the network! The Sniffer tool is actually a network
The packet capture tool also analyzes captured packets. In a shared network, information packets are broadcast to all hosts in the network.
But before using the sniffer tool, the network device of the host determines whether the information package should be received.
It will discard the information packages that should not be received, but the sniffer tool will make the network devices of the host receive all the information packets, so as to achieve
Network listening effect.
Data collection and analysis is essential when Linux is a network server, especially a router or gateway. So, today we
Let's take a look at TcpDump, a powerful network data collection and analysis tool in Linux.
To define tcpdump in a simple way, dump the traffice on a network.
A packet analysis tool that intercepts data packets.
As a necessary tool for the classic system administrator on the internet, tcpdump becomes an advanced
System Administrators can analyze networks and troubleshoot problems.
As the name suggests, TcpDump can completely intercept the "Header" of the packets transmitted in the network for analysis. It supports
Discuss, host, network or port filtering, and provide and, or, not and other logic statements to help you remove useless information.
Tcpdump provides source code and exposes interfaces. Therefore, tcpdump is highly scalable and useful for network maintenance and intruders.
Tool. Tcpdump exists in the basic FreeBSD system, because it needs to set the network interface to the mixed mode, normal users cannot
But users with root permissions can directly execute the command to obtain information on the network. Therefore, network analysis tools exist in the system.
It is a threat to the security of the local machine, but to the security of other computers on the network.
Under normal circumstances, directly starting tcpdump will monitor all the data packets flowing through the first network interface.
-----------------------
