TCPDUMP 简单使用

tcpdump -i eth0  -s0 -A  port 80 -nn  > dump.ef.log

参数	作用
-i	指定网卡,如果是local,则是lo
-nn	不进行端口名称的转换。11:10:50.148051 IP report.api.youku.com.http变成11:18:34.315665 IP 10.10.73.120.80
-s	修改每个报文中截取snaplen字节的数据,缺省的是65535。
-A	以ASCII格式打印出所有分组，并将链路层的头最小化。

-A 可以把格式转换:

11:37:35.948888 IP 10.10.73.120.15798 > 10.10.73.120.80: Flags [.], ack 1, win 9, length 0
11:37:35.948966 IP 10.10.73.120.15798 > 10.10.73.120.80: Flags [P.], seq 1:479, ack 1, win 9, length 478

to

11:41:59.285175 IP 10.10.73.120.15835 > 10.10.73.120.80: Flags [.], ack 1, win 9, length 0E..(..@.@...IxIx=..Pq...OL#.P..   ?...
11:41:59.285232 IP 10.10.73.120.15835 > 10.10.73.120.80: Flags [P.], seq 1:479, ack 1, win 9, length 478
appid=1001&fromuid=1001&ts=1449632519&sig=8b55291e5941601104c5e802cda9fb6a&type=&display=1&term=62&tplid=1&contents=%7B%22title%22%3A%22234234%22%2C%22ifo%22%3A%22234234%22%2C%22btnname%22%3A%222423%22%2C%22link%22%3A%22%22%2C%22img%22%3A%22%22%7D&expire_time=1450318800&access_time=1449540000&fade=34&popup=1&jumptype=0&iosdata=&anddata=
11:41:59.285239 IP 10.10.73.120.80 > 10.10.73.120.15835: Flags [.], ack 479, win 9, length 0
E..(lT@.@.'x