Today, the network is cut off and a large number of UDP packets are sent out. the tcpdump command is used in the hometown introduction. the tcpdump command is first installed in apt-getinstalltcpdump (Debian of the Gateway system, then use the tcpdumpudp-ieth1 to view the udp packet situation of the intranet, locate the specific machine, as follows, and then further view the cause tcpdump-ieth1srch
| Today, the network is cut off and a large number of UDP packets are sent out.TcpdumpCommand, first apt-get installTcpdump(Debian in the Gateway system) is installed with tcpdump. Then, use tcpdump udp-ieth1 to view the udp packets in the intranet, locate the specific machine, as shown below, and further check the cause tcpdump-I eth1 src host192.168.0.144. Tcpdump adopts the command line method. the command format is: (zz from net)
Tcpdump [-adeflnNOpqStvx] [-c quantity] [-F file name]
[-I network interface] [-r file name] [-s snaplen]
[-T type] [-w file name] [expression]
Introduction to tcpdump options
-A converts a network address and broadcast address into a name;
-D. give the code that matches the information package in an assembly format that people can understand;
-Dd provides the code that matches the information package in the format of the C program segment;
-Ddd provides the matching information package code in decimal format;
-E prints the header information of the data link layer in the output line;
-F print the Internet address in numbers;
-L changes the standard output to the buffer row format;
-N does not convert the network address into a name;
-T no timestamp is printed on each output line;
-V outputs a slightly detailed information. for example, the IP package can contain ttl and service type information;
-Vv: output detailed message information;
-C. after receiving the specified number of packages, tcpdump stops;
-F read the expression from the specified file and ignore other expressions;
-I indicates the network interface of the listener;
-R reads packets from a specified file (these packets are generally generated using the-w option );
-W directly writes the package into the file and does not analyze or print it out;
-T directly interpret the listening packet as a specified type of message. Common types include rpc (remote process call) and snmp (Simple Network Management Protocol ;) |
