对付黑客用Tcptrack跟踪TCP连接的利器

一、安装tcptrack rpm包 Download Tcptrack rpmfrom http://packages.sw.be/tcptrack/ by selecting your OS and arch : cd /usr/src wget http://packages.sw.be/tcptrack/tcptrack-1.1.5-1.2.el5.rf.i386.rpm rpm -ivh tcptrack-1.1.5-1.2.el5.rf.i386.rpm 复制代码 Install TCPtrack from source 二、通过下载源码安装 Download TCPtrack source from :http://www.rhythm.cx/~steve/devel/tcptrack/release/ tar zxvf tcptrack-1.3.0.tar.gz cd tcptrack-1.3.0 ./configure ; make & make install 复制代码 三、使用参考： Run ‘ tcptrack -h ‘ to list help menu : Usage: tcptrack [-dfhvp] [-r <seconds>] -i <interface> [<filter expression>] TCPtrack can monitor only one nic at once with only one parameter to run (if you have two nic ie.. eth0 & eth1 ) # tcptrack -i eth0 # tcptrack -i eth1 Tcptrack can also take a pcap filter expression as an argument. The format of this filter expression is the same as that of tcpdump(8) and other libpcap-based sniffers. The following example will only show connections from host 68.36.45.78: # tcptrack -i eth0 src or dst 68.36.45.78 To monitor the specific ports (ie..port 80 and 22): # tcptrack -i eth0 port 80 # tcptrack -i eth0 port 22 来源：http://www.gnutoolbox.com/tcptrack/