Tcpdump very practical Grab Pack 12 example

Source: Internet
Author: User
Tags ack

1. Filter the Host
----------------------------------------------------------------

-Crawl all eth1, destination or source address is 192.168.1.1 network data # tcpdump-i ETH1 host 192.168.1.1-Source address # tcpdump-i eth1 SRC host 192.168.1.1-Destination address # tcpdump-i eth1 DST host 192.168.1.1

2. Filter port
----------------------------------------------------------------

-Crawl all eth1, destination or source port is 25 network data # Tcpdump-i eth1 port 25-Source Port # tcpdump-i eth1 SRC port 25-Destination Port # tcpdump-i eth1 DST Port 25

3, Network filtering
----------------------------------------------------------------

# tcpdump-i eth1 net 192.168# tcpdump-i eth1 src net 192.168# tcpdump-i eth1 DST net 192.168

4. Protocol filtering
----------------------------------------------------------------

# tcpdump-i eth1 arp# tcpdump-i eth1 ip# tcpdump-i eth1 tcp# tcpdump-i eth1 udp# tcpdump-i eth1 ICMP

5. Common expressions
----------------------------------------------------------------

Non -:! or "not" (minus double quotes) and: && or "and" or: | | or "or"-fetch all the eth1, the destination address is the TCP data of the 192.168.1.254 or 192.168.1.200 port is 80 # tcpdump-i eth1 ' ((TCP) and (port) and (DST Host 192.168.1.254) or (DST host192.168.1.200)) '-Crawl all the eth1, the destination MAC address is 00:01:02:03:04:05 ICMP data # tcpdump-i eth1 ' (( ICMP) and ((Ether DST host 00:01:02:03:04:05)) '-Crawl all the eth1, the destination network is 192.168, but the destination host is not 192.168.1.200 TCP data # tcpdump-i ETH 1 ' ((TCP) and ((DST net 192.168) and (not DST host 192.168.1.200)) '

6. Catch only SYN Packets
----------------------------------------------------------------

# tcpdump-i eth1 ' tcp[tcpflags] = Tcp-syn '

7. Catch SYN, ACK
----------------------------------------------------------------

# tcpdump-i eth1 ' tcp[tcpflags] & Tcp-syn! = 0 and Tcp[tcpflags] & Tcp-ack! = 0 '

8. Grasping SMTP Data

----------------------------------------------------------------

# tcpdump-i Eth1 ' ((port) and (tcp[(TCP[12]>>2): 4] = 0x4d41494c)) ' Crawl data area starts as ' mail ' package, ' mail ' hex is 0x4d41494c.

9. Grabbing HTTP GET data
----------------------------------------------------------------

# tcpdump-i eth1 ' tcp[(TCP[12]>>2): 4] = 0x47455420 ' GET ' hex is 47455420

10. Catch SSH Back
----------------------------------------------------------------

# tcpdump-i eth1 ' tcp[(TCP[12]>>2): 4] = 0x5353482d ' "ssh-" hex is 0x5353482d# tcpdump-i eth1 ' (tcp[(tcp[12]>> 2): 4] = 0x5353482d) and (tcp[((tcp[12]>>2) +4): 2]= 0x312e) ' Catch the old version of SSH return information, such as ' SSH-1.99. '

11. Grasping DNS Request data
----------------------------------------------------------------

# tcpdump-i eth1 UDP DST Port 53

12. Capture the Get packet of port number 8000 in real time and write to GET.log
----------------------------------------------------------------

Tcpdump-i eth0 ' (Port 8000) and (tcp[(tcp[12]>>2): 4]=0x47455420)) '-nnal-w/tmp/get.log

Other
----------------------------------------------------------------
The-c parameter is also more commonly used for operation and maintenance personnel, because the traffic is relatively large server, by manual CTRL + C or
Grasping too much, so you can use the-c parameter to specify how many packets to catch.

# time Tcpdump-nn-i eth0 ' tcp[tcpflags] = Tcp-syn '-C 10000 >/dev/null The above command calculates how long it takes to catch 10,000 syn packets, and you can tell what the traffic is about.

Tcpdump very practical Grab Pack 12 example

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.