tcpdump使用方法

Tcpdump is a CLI tool to capture raw network packets. This is useful for various forms of network troubleshooting. This cheat sheet covers all the basic and advanced options for tcpdump.

Tcpdump cheat sheet

how-to-use-tcpdump

Tcpdump command is a famous network packet analyzing tool that is used to display TCP\IP & other network packets being transmitted over the network attached to the system on which tcpdump has been installed. Tcpdump uses libpcap library to capture the network packets & is available on almost all Linux/Unix flavors.

Capture ICMP Packets With Tcpdump

Debugging SSH Packets with Tcpdump

Using Tcpdump to Filter DNS Packets

Learn tcpdump Quick Guide

Linux Tcpdump: Filter ipv6 ntp ping packets

Tcpdump: capture DHCP & DHCPv6 packets

20 Advanced Tcpdump Examples On Linux

10 Useful tcpdump command examples

TCPDUMP

README

Tcpdump is one of the best network analysis-tools ever for information security professionals.

Tcpdump is for everyone for hackers and people who have less of TCP/IP understanding.

OPTIONS

Below are some tcpdump options (with useful examples) that will help you working with the tool. They’re very easy to forget and/or confuse with other types of filters, i.e. ethereal, so hopefully this article can serve as a reference for you, as it does me:)

• The first of these is -n, which requests that names are not resolved, resulting in the IPs themselves.
• The second is -X, which displays both hex and ascii content within the packet.
• The final one is -S, which changes the display of sequence numbers to absolute rather than relative.

Show the packet’s contents in both hex and ascii.

tcpdump -X ....         

Same as -X, but also shows the ethernet header.

tcpdump -XX

Show the list of available interfaces

tcpdump -D

Line-readable output (for viewing as you save, or sending to other commands)

tcpdump -l

Be less verbose (more quiet) with your output.

tcpdump -q

Give human-readable timestamp output.

tcpdump -t :

Give maximally human-readable timestamp output.

tcpdump -tttt : 

Listen on the eth0 interface.

tcpdump -i eth0

Verbose output (more v’s gives more output).

tcpdump -vv 

Only get x number of packets and then stop.

tcpdump -c 

Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.

tcpdump -s 

Print absolute sequence numbers.

tcpdump -S 

Get the ethernet header as well.

tcpdump -e 

Decrypt IPSEC traffic by providing an encryption key.

tcpdump -E

For more options, read manual:

• Find all options here
• Linux Tcpdump: Filter ipv6 ntp ping packets
• Tcpdump: capture