抓取http get请求头:
tcpdump -i eth0 -s 0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
抓取http post请求头请求体:
tcpdump -i eth0 -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'
抓取http请求头请求体和响应头响应体:
tcpdump -i eth0 -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
抓取redis包:
tcpdump -i eth0 -A -s 0 'host 172.16.18.111 and tcp port 6379 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
抓取长度大于某个值的包:
tcpdump -i any 'port 80 and ip[2:2] > 576'
抓取mysql包:
tcpdump -i eth0 -s 0 -l -w - dst host 127.0.0.1 and port 3306 | strings
或只指定端口:
tcpdump -i eth0 -s 0 -l -w - port 3306 | strings
抓取mongo包(tcpdump不支持mongo协议,可以换成strace):
strace -s 256 -e 'trace=network' -f -p ${mongo_pid} 2>&1 | grep ${mongo_table_name}
抓取和某个ip的请求和响应包,并只显示前100个字符:
tcpdump -i eth0 -s 0 -l -w - host 172.16.18.111 | strings | awk '{print substr($0,0,100)}'
查看某个进程连接的远端:
lsof -nPp $pid
或
strace -e 'trace=connect,read,sendto' -f -p $pid
抓取某个协议的包,如vrrp协议:
tcpdump -n -i eth0 vrrp
--end--