HP-UX下的抓包工具nettl

当我们搞不清unix/linux下的某个工具怎么用时最可靠也最有效的办法就是：看工具的联机手册，man nettl。

使用nettl抓包工具必须在root用户下执行。简单列个小的抓包例子：

# cd /tmp
# nettl -start
Initializing Network Tracing and Logging...
Done. 
# nettl -tn all -e ns_ls_tcp -tm 60M -f /tmp/net1

参数： -tn （-traceon的简写，开始在指定的subsystems类型上捕获报文）

-e （-entity的简写，后接subsystems类型，这里我们要抓取的是tcp报文）

-tm （-tracemax的简写，后接maxsize，指定抓包大小）

-f （-file的简写，后接抓取后的数据包的名字）

# nettl -status all

Logging Information:
Log Filename:                           /var/adm/nettl.LOG0*
Max Log file size(Kbytes):   1000       Console Logging:        On
User's ID:                   0          Buffer Size:            8192
Messages Dropped:            0          Messages Queued:        0

Subsystem Name:                 Log Class:
NS_LS_LOGGING                                              ERROR DISASTER
NS_LS_NFT                                                  ERROR DISASTER
NS_LS_LOOPBACK                                             ERROR DISASTER
NS_LS_NI                                                   ERROR DISASTER
NS_LS_IPC                                                  ERROR DISASTER
NS_LS_SOCKREGD                                             ERROR DISASTER
NS_LS_TCP                                                  ERROR DISASTER
NS_LS_PXP                                                  ERROR DISASTER
NS_LS_UDP                                                  ERROR DISASTER
NS_LS_IP                                                   ERROR DISASTER
NS_LS_PROBE                                                ERROR DISASTER
NS_LS_DRIVER                                               ERROR DISASTER
NS_LS_RLBD                                                 ERROR DISASTER
NS_LS_BUFS                                                 ERROR DISASTER
NS_LS_CASE21                                               ERROR DISASTER
NS_LS_ROUTER21                                             ERROR DISASTER
NS_LS_NFS                                                  ERROR DISASTER
NS_LS_NETISR                                               ERROR DISASTER
NS_LS_NSE                                                  ERROR DISASTER
NS_LS_STRLOG                                               ERROR DISASTER
NS_LS_TIRDWR                                               ERROR DISASTER
NS_LS_TIMOD                                                ERROR DISASTER
NS_LS_ICMP                                                 ERROR DISASTER
FILTER                                                     ERROR DISASTER
NAME                                                       ERROR DISASTER
NS_LS_IGMP                                                 ERROR DISASTER
FC                                                         ERROR DISASTER
FORMATTER                                                  ERROR DISASTER
STREAMS                                                    ERROR DISASTER
BASE100                                                    ERROR DISASTER
PCI100BT                                                   ERROR DISASTER
SPP100BT                                                   ERROR DISASTER


Tracing Information:
Trace Filename:                         /tmp/net1.TRC*
Max Trace file size(Kbytes): 61440   
User's ID:                   0          Buffer Size:            69632
Messages Dropped:            0          Messages Queued:        0

Subsystem Name:      Trace Mask:
NS_LS_TCP            0xFFFF0000 
# ls -l net*
-rw-------   1 root       sys          82708 Mar  4 14:21 net1.TRC0
# nettl -traceoff -e all
# nettl -stop
#

抓完包后就要开始解析了，我们用netfmt工具来查看捕获到的包。我们用netfmt工具解析抓到的包的结果重定向到一个文件里，然后用vi查看：

# netfmt -N -l -f /tmp/net1.TRC* > net1.log

# vi net1.log
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ARPA/9000 NETWORKING^^^^^^^^^^^^^^^^^^^^^^^^^^@#%
  Timestamp            : Mon Mar 04 EAT 2013 14:20:31.574886
  Process ID           : [ICS]              Subsystem        : NS_LS_TCP
  User ID ( UID )      : -1                 Trace Kind       : PDU IN TRACE
  Device ID            : -1                 Path ID          : 0
  Connection ID        : 0
  Location             : 00123
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-------------------------------- TCP Header ----------------------------------
sport:   22   -->   dport:  64329     flags: PUSH ACK
       seq: 0xf3d150c6  urp: 0x0      chksum: 0x5f1e   data len: 272
       ack: 0x7042bcdd  win: 0x60f4   optlen: 0
-------------------------------- User Data -----------------------------------
   0: 2f 73 e5 c8 9a f9 04 43 76 bc 4a cd 8e 43 24 15  /s.....Cv.J..C$.
  16: f0 ab 62 d6 7a 65 ce b7 11 44 43 ce 1a 94 a7 13  ..b.ze...DC.....
  32: 97 85 57 3d 6e bf bf ed 21 e2 ed 44 b3 35 d2 02  ..W=n...!..D.5..
  48: f9 ea f1 d1 22 83 6c c2 90 90 78 c1 d4 9c 5a 32  ....".l...x...Z2
  64: 0e b3 87 11 70 0b d2 79 de d3 1e 75 f8 ec c7 92  ....p..y...u....
  80: 5b d3 d2 06 15 7e 14 83 38 22 3f 74 6b 07 11 c0  [....~..8"?tk...
  96: 84 77 37 b5 9d 58 63 01 85 85 d6 53 2e 54 c4 68  .w7..Xc....S.T.h
 112: 89 ab 09 a1 e2 0c 0b 6b ee 10 c9 d4 cf 2c ba 49  .......k.....,.I
 128: cc 40 a0 4c 1e 7a 48 bb 00 b6 d9 b5 61 40 44 bd  .@.L.zH.....a@D.
 144: 08 fd a7 f9 ff d4 87 8c b0 7b e7 a6 12 b2 0c a6  .........{......
 160: a5 15 5f 06 4d 32 dc 2f 0b 28 5d 54 9d 3e b8 4f  .._.M2./.(]T.>.O
 176: 52 c3 4c 9b 39 4f eb 65 c4 33 27 44 7b 34 97 40  R.L.9O.e.3'D{4.@
 192: 0d 03 3f 5d 22 5e 5e 04 92 3e a5 18 32 54 2a 44  ..?]"^^..>..2T*D
 208: 30 c3 7e f9 4b 20 93 22 40 16 b8 6a 72 7f 35 79  0.~.K ."@..jr.5y
 224: a7 35 b2 79 09 31 c5 b7 48 d0 e8 ee 04 a6 32 db  .5.y.1..H.....2.
 240: 96 46 62 6e 19 6b c7 3d bc 43 f9 d2 0d c8 cd 06  .Fbn.k.=.C......
 256: 94 0d b2 9a e1 3d df 56 d9 49 c6 54 fe 03 9c e5  .....=.V.I.T....