Tcpdump a very practical example of grabbing a bag

Original address: http://blog.csdn.net/nanyun2010/article/details/23445223

For detailed documentation see Tcpdump Advanced filtering Tips

Basic syntax

========
Filter Host
--------
-Crawl all eth1, destination or source address is 192.168.1.1 network data
# tcpdump-i ETH1 Host 192.168.1.1
-Source Address
# tcpdump-i eth1 src host 192.168.1.1
-Destination Address
# tcpdump-i eth1 DST host 192.168.1.1
Filter port
--------
-Crawl all eth1, destination or source port is 25 of network data
# tcpdump-i Eth1 Port 25
-Source Port
# tcpdump-i eth1 Src port 25
-Destination Port
# tcpdump-i ETH1 DST port 25 network filtering
--------
# tcpdump-i eth1 Net 192.168
# tcpdump-i eth1 src net 192.168
# Tcpdump-i eth1 DST net 192.168

Protocol filtering
--------
# tcpdump-i eth1 ARP
# tcpdump-i eth1 IP
# tcpdump-i Eth1 TCP
# tcpdump-i eth1 UDP
# tcpdump-i eth1 ICMP

Common expressions
----------
Non -:! or "not" (remove double quotes)
And: && or "and"
Or: | | or "or"
-Crawl all eth1, destination address is TCP data with 192.168.1.254 or 192.168.1.200 port is 80
# tcpdump-i eth1 ' ((TCP) and (port) and (DST host 192.168.1.254) or (DST host
192.168.1.200))) '
-Crawl all eth1, destination MAC address is 00:01:02:03:04:05 ICMP data
# tcpdump-i eth1 ' ((ICMP) and ((Ether DST host 00:01:02:03:04:05)) '
-Crawl all through eth1, the destination network is 192.168, but the destination host is not 192.168.1.200 TCP data

# tcpdump-i eth1 ' ((TCP) and ((DST net 192.168) and (not DST host 192.168.1.200)) '

-Catch only SYN packets
# tcpdump-i eth1 ' tcp[tcpflags] = Tcp-syn '
-Catch SYN, ACK
# tcpdump-i eth1 ' tcp[tcpflags] & Tcp-syn! = 0 and Tcp[tcpflags] & Tcp-ack! = 0 '
Grasping SMTP data
----------
# tcpdump-i Eth1 ' ((port) and (tcp[(TCP[12]>>2): 4] = 0x4d41494c)) '
Grab the packet starting with "mail" in the data area and "mail" in hex 0x4d41494c.
Grab HTTP GET Data
--------------
# tcpdump-i eth1 ' tcp[(TCP[12]>>2): 4] = 0x47455420 '
The hex of "GET" is 47455420
Catch SSH back
---------
# tcpdump-i eth1 ' tcp[(TCP[12]>>2): 4] = 0x5353482d '
The hexadecimal of "ssh-" is 0x5353482d

# tcpdump-i eth1 ' (tcp[(TCP[12]>>2): 4] = 0x5353482d) and (tcp[((tcp[12]>>2) +4): 2]
= 0x312e) ' Catch the old version of SSH return information, such as ' SSH-1.99. '

-Grasping DNS request data
# tcpdump-i eth1 UDP DST Port 53
Other
----
The-c parameter is also more commonly used for operation and maintenance personnel, because the traffic is relatively large server, by manual CTRL + C or
Grasping too much, so you can use the-c parameter to specify how many packets to catch.
# time Tcpdump-nn-i eth0 ' tcp[tcpflags] = Tcp-syn '-C 10000 >/dev/null
The above command calculates how much time it takes to catch 10,000 SYN packets, and you can tell what the traffic is about.

Fetch the port number 8000 in real-time, then write GET.log

Tcpdump-i eth0 ' (Port 8000) and (tcp[(tcp[12]>>2): 4]=0x47455420)) '-nnal-w/tmp/get.log

Tcpdump a very practical example of grabbing a bag