Step 5 of tcpdump

The first four moves are all about tcpdump options. from this move, we will focus on the more commonly used "filter expressions" content. With these learning techniques, you will be able to do your best. [Master's Portal] it can send a "filter expression" to tcpdump to filter network packets. It also supports data transfer.

The first four moves are centered onTcpdumpFrom this move, we will turn to the more common "filter expression" content.

With these learning techniques, you will be able to do your best.

=

Master leads the door]

Tcpdump can be transferred with a "filter expression" to filter network packets. In addition, tcpdump supports passing in one or more filter expressions.

When the filter expression you pass in contains shell wildcards, do not forget to enclose the expressions with single quotes, in case that shell automatically claims that the expressions containing wildcards are interpreted and configured first.

If you want to study "filter expressions" by yourself, I will tell you how to "enter":

Man pcap-filter

You will find that the filter expression can be roughly divided into three filter conditions: "type", "direction", and "protocol". The combination of these three conditions constitutes our filter expression.

[I only want to capture UDP packets and do not want to be disturbed by TCP packets]

# Tcpdump-I eth0-c 10 \ 'udp \'
Tcpdump: verbose output suppressed, use-v or-vv for full protocol decode
Listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:25:20. 801612 IP 116.20.245.48.54808> 229.111.112.12.csd-mgmt-port: UDP, length 4
11:25:20. 802120 IP 116.20.245.206.54313> ns. SC .cninfo.net. domain: 5256 + PTR? 12.112.111.229.in-addr. arpa. (45)
11:25:21. 145126 IP ns. SC .cninfo.net. domain> 116.20.245.206.54313: 5256 NXDomain 0/0/0 (45)
11:25:21. 145315 IP 116.20.245.206.46658> ns. SC .cninfo.net. domain: 15551 + PTR? 48.245.109116.in-addr. arpa. (45)
11:25:21. 153966 IP 116.20.245.43.62220> 229.111.112.12.csd-mgmt-port: UDP, length 4
11:25:21. 180135 IP 116.20.245.61.hsrp> all-routers.mcast.net.hsrp: HSRPv0-hello 20: state = active group = 21 addr = 116.20.245.33
11:25:21. 231151 IP ns. SC .cninfo.net. domain> 116.20.245.206.46658: 15551 NXDomain 0/0/0 (45)
11:25:21. 231430 IP 116.20.245.206.46158> ns. SC .cninfo.net. domain: 31924 + PTR? 69.2.139.61.in-addr. arpa. (42)
11:25:21. 277087 IP ns. SC .cninfo.net. domain> 116.20.245.206.46158: 31924 1/0/0 PTR ns. SC .cninfo.net. (72)
11:25:21. 277824 IP 116.20.245.206.20.56> ns. SC .cninfo.net. domain: 806 + PTR? 206.245.20.116.in-addr. arpa. (46)
10 packets captured
20 packets partitioned ed by filter
0 packets dropped by kernel

For example, tcpdump can filter packets based on the network packet protocol. we can also change udp to ether, ip, ip6, arp, tcp, and rarp.

Maybe you will ask, "Why are there no application-layer protocols in these protocols ?", In fact, the reason is very simple. the application layer protocol is not a basic network protocol and is often added or eliminated. tcpdump will not go deep into the application layer for Intelligent Resolution. Therefore, the Protocols supported by tcpdump are below the application layer.

[I want to view the network package between the source machine and the target machine. I don't want to be disturbed by other irrelevant Machines]

This is actually very simple and intuitive. you only need to set src (source) and dst (destination). Moreover, tcpdump also supports the combination of and or!

If this parameter is not set, the default value is src or dst.

# Tcpdump-I eth0 \ 'dst 8.8.8.8 \'
Tcpdump: verbose output suppressed, use-v or-vv for full protocol decode
Listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:21:23. 281978 IP 116.20.245.206> google-public-dns-a.google.com: ICMP echo request, id 23081, seq 1, length 64
13:21:24. 286663 IP 116.20.245.206> google-public-dns-a.google.com: ICMP echo request, id 23081, seq 2, length 64
13:21:25. 288612 IP 116.20.245.206> google-public-dns-a.google.com: ICMP echo request, id 23081, seq 3, length 64
^ C
3 packets captured
5 packets partitioned ed by filter
0 packets dropped by kernel

[I only want to check if the target machine port is a network package of 53 or 80. I do not pay attention to other ports]

# Tcpdump-I eth0-c 3 \ 'dst port 53 or dst port 80 \'
Tcpdump: verbose output suppressed, use-v or-vv for full protocol decode
Listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:29:04. 530130 IP 114.20.192.96.29832> 116.20.245.206.http: Flags [S], seq 3169042560, win 5840, options [mss 1460, sackOK, TS val 2949111416 ecr 0], length 0
13:29:04. 530660 IP 116.20.245.206.43211> ns. SC .cninfo.net. domain: 40188 + PTR? 206.245.20.116.in-addr. arpa. (46)
13:29:04. 548589 IP 114.20.192.96.29832> 116.20.245.206.http: Flags [.], ack 3709396068, win 5840, options [nop, nop, TS val 2949111475 ecr 1601243970], length 0
3 packets captured
10 packets partitioned ed by filter
0 packets dropped by kernel

We can set the filter type. in the preceding example, we use the port type to specify the port. Tcpdump also supports the following types:

1 host: specifies the host name or IP address, for example, 'hostroclinux 'or 'host 202.112.18.34 ′

2 net: specify the network segment, for example, 'arp net 128.3 'or 'dst net128.3 ′

3 portrange: specifies the port area, for example, 'src or dstportrange 6000-6008 ′

If the filter type is not set, the default value is host.

Thank you!

I think the article is useful? Now: with friends Total learning progress!