linux系统USB抓包方法

Window系统下USB抓包软件工具很多,但linux下USB抓包软件较少,linux系统中可以用wireshark和tcpdump对USB数据进行抓取。Linux下Wireshark和windows版本使用方法相同,下面主要分析下tcpdump的使用方法。

使用Wireshark和tcpdump前需要先安装usbmon.ko驱动,一般系统都已经将其编译到内核,输入命令tcpdump –D查看系统是否安装usbmon驱动。

如果打印信息包含usbmon内容则说明已经安装usbmon驱动。如果没有安装查看驱动目录:/lib/modules/4.4.131-20200710.kylin.desktop-generic/kernel/drivers/usb/mon/中是否有usbmon.ko,(系统版本号根据自己的系统不同),如果没有需要配置内核,将USB Monitor编译成模块。USB Monitor配置项位置如下所示:

Device Drivers  --->

USB support  --->

 <M>     USB Monitor

然后重新编译内核。编译生成usbmon.ko后通过命令modprobe usbmon安装驱动,安装后通过lsmod命令可以查看是否安装成功:

 

安装驱动后再次输入tcpdump –D命令查看,如果相关usbmon接口信息存在,我们就可以通过tcpdump工具抓取usb包了。

根权限下输入命令:tcpdump -i usbmon1对USB总线1上的所有设备进行监测:

也可以使用命令:tcpdump -i usbmon1 -w usb.pcap将抓取的包数据存入文件usb.pcap中,然后用wireshark进行分析。

 

 

  • 0
    点赞
  • 5
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
Ethereal is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. See: http://www.ethereal.com for new versions, documentation, ... Ethereal's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. So Ethereal can read capture files from: -libpcap/WinPcap, tcpdump and various other tools using tcpdump's capture format -snoop and atmsnoop -Shomiti/Finisar Surveyor captures -Novell LANalyzer captures -Microsoft Network Monitor captures -AIX's iptrace captures -Cinco Networks NetXRay captures -Network Associates Windows-based Sniffer captures -Network General/Network Associates DOS-based Sniffer (compressed or uncompressed) captures -AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures -RADCOM's WAN/LAN analyzer captures -Network Instruments Observer version 9 captures -Lucent/Ascend router debug output -files from HP-UX's nettl -Toshiba's ISDN routers dump output -the output from i4btrace from the ISDN4BSD project -traces from the EyeSDN USB S0. -the output in IPLog format from the Cisco Secure Intrusion Detection System -pppd logs (pppdump format) -the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities -the text output from the DBS Etherwatch VMS utility -Visual Networks' Visual UpTime traffic capture -the output from CoSine L2 debug -the output from Accellent's 5Views LAN agents -Endace Measurement Systems' ERF format captures -Linux Bluez Bluetooth stack hcidump -w traces There is no need to tell Ethereal what type of file you are reading; it will determine the file type by itself. Ethereal is also capable of reading any of these file formats if they are compressed using gzip. Ethereal recognizes this directly from the file; the '.gz' extension is not required for this purpose.

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

缥缈孤鸿_jason

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值