指定要监听的网络接口,例如:sudo tcpdump -i eth0 3. 按 IP 地址过滤:sudo tcpdump host [ip_address] 只捕获与指定 IP 地址相关的流量:sudo tcpdump host 192.168.1.100 4. 按端口过滤:sudo tcpdump port [port_number] 捕获指定端口的流量:sudo tcpdump port 80 5. 按协议过滤:sudo tcpdump proto [...
找出一段时间内发包最多的 IP,或者从一堆报文中找出发包最多的 IP,可以使用下面的命令: $ tcpdump -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enp...
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 21:02:19.112502 IP test33.ntp > 199.30.140.74.ntp: NTPv4, Client, length 48 21:02:19.113888 IP 216.239.35.0.ntp > test33.ntp: NTPv4, ...
= 0 and not src and dst net 192.168.2.170' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens3f0, link-type EN10MB (Ethernet), capture size 262144 bytes 14:54:53.562553 IP 192.168.2.170.44642 > tl-in-f139.1e100.net.https: Flags ...
监听IP之间的包 tcpdump ip host 192.168.1.11 and 192.168.1.60 11:57:52.742468 IP 192.168.1.11.38978 > hello.http: Flags [S], seq 3437424457, win 64240, options [mss 1460,sackOK,TS val 2166810854 ecr 0,nop,wscale 7], length 0
监听目标地址IP tcpdump dst host 192.168.1.11 监听指定端口 tcpdump port 80 监听TCP tcpdump tcp 监听UDP tcpdump udp 监听192.168.1.11的tcp协议的80端口的数据包 tcpdump tcp port 80 and src host 192.168.1.11 11:59:07.836563 IP 192.168.1.11.39680 > hello.http: Flags [.], ack 867022485, win...
00 target-IP-address=202.102.245.3 --- Packet 3 TIME:12:01:01.985023 (0.910510) LINK:00:10:7B:08:3A:56 -> 01:80:C2:00:00:00 type=0026 <*** No decode support for encapsulated protocol ***> tcpshow能以不同方式对数据包进行解码,并以不同的方式显示解码数据,使用者可以根据其手册...
host ip_address 只输出指定 host 的数据包 tcpdump-i eth1-c10host115.231.100.10-s0-w/home/fangwenjun/tcp.pcap 保存为 wireshark 可以打开的格式,-s0 表示输出完整的报文头,防止被截断。 tcpdump host210.27.48.1and/(210.27.48.2or210.27.48.3/) ...
Server-IP 10.10.1.1 Client-Ethernet-Address 00:0c:xx:xx:xx:d5 Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message Option 53, length 1: ACK Server-ID Option 54, length 4: 10.10.1.1 Lease-Time Option 51, length 4: 86400 ...
tcpdump ip host 192.168.1.11 and 192.168.1.60 11:57:52.742468 IP 192.168.1.11.38978 > hello.http: Flags [S], seq 3437424457, win 64240, options [mss 1460,sackOK,TS val 2166810854 ecr 0,nop,wscale 7], length 0 11:57:52.742606 IP hello.http > 192.168.1.11.38978: Flags [S.], seq...