抓取http get请求头:
tcpdump -i eth0 -n -nn -s 0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
抓取http post请求头请求体:
tcpdump -i eth0 -n -nn -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'
抓取http请求头请求体和响应头响应体:
tcpdump -i eth0 -n -nn -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
抓取任意接口设备多个端口的http请求和响应:
tcpdump -i any -n -nn -A -s 0 '(tcp port 9090 or tcp port 80) and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
抓取任意接口设备多个端口的http请求和响应以及打开和关闭连接:
tcpdump -i any -n -nn -A -s 0 '(tcp port 80 or tcp port 8686) and ((((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)) or ((tcp[13]&0x1)==1 or (tcp[13]&0x2)==2)'
抓取redis包:
tcpdump -i eth0 -n -nn -A -s 0 'host 172.16.18.111 and tcp port 6379 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
抓取长度大于某个值的包:
tcpdump -i any 'port 80 and ip[2:2] > 576'
抓取mysql包:
tcpdump -i eth0 -s 0 -l -w - dst host 127.0.0.1 and port 3306 | strings
或只指定端口:
tcpdump -i eth0 -s 0 -l -w - port 3306 | strings
抓取mongo包(tcpdump不支持mongo协议,可以换成strace):
strace -s 256 -e 'trace=network' -f -p ${mongo_pid} 2>&1 | grep ${mongo_table_name}
抓取和某个ip的请求和响应包,并只显示前100个字符:
tcpdump -i eth0 -s 0 -l -w - host 172.16.18.111 | strings | awk '{print substr($0,0,100)}'
查看某个进程连接的远端:
lsof -nPp $pid
或
strace -e 'trace=connect,read,sendto' -f -p $pid
抓取某个协议的包,如虚拟路由冗余协议:
tcpdump -n -i eth0 vrrp
抓取局域网组播管理协议:
tcpdump -n -i eth0 igmp
tcp flags:
Capturing TCP packets with particular flag combinations (SYN-ACK, URG-ACK, etc.)
There are 8 bits in the control bits section of the TCP header:
CWR | ECE | URG | ACK | PSH | RST | SYN | FIN
根据SYN flag抓包,抓取建立连接的包:
tcpdump -n -nn -i any '(tcp[13]&0x2)==2'
根据FIN flag抓包,抓取关闭连接的包:
tcpdump -n -nn -i any '(tcp[13]&0x1)==1'
同时抓取打开和关闭连接的包:
tcpdump -n -nn -i any '(tcp[13]&0x1)==1 or (tcp[13]&0x2)==2'
根据RST flag抓包,抓取异常关闭连接的包:
tcpdump -n -nn -i any '(tcp[13]&0x4)==4'
抓取unix stream:
// backup the socket
sudo mv /var/run/docker.sock /var/run/docker.sock.original
// use tcp port 8089 proxy the original socket
sudo socat TCP-LISTEN:8089,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sock.original
// use the new socket to proxy the 8089 port
sudo socat UNIX-LISTEN:/var/run/docker.sock,fork TCP-CONNECT:127.0.0.1:8089
// like cap tcp
sudo tcpdump -i lo -netvv port 8089
--end--