Linux tcpdump 抓包

tcpdump --help

root@kali:~# tcpdump --help
tcpdump version 4.9.2
libpcap version 1.8.1
OpenSSL 1.1.1b  26 Feb 2019
Usage: tcpdump [-aAbdDefhHIJKlLnNOpqStuUvxX#] [ -B size ] [ -c count ]
		[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
		[ -i interface ] [ -j tstamptype ] [ -M secret ] [ --number ]
		[ -Q in|out|inout ]
		[ -r file ] [ -s snaplen ] [ --time-stamp-precision precision ]
		[ --immediate-mode ] [ -T type ] [ --version ] [ -V file ]
		[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]
		[ -Z user ] [ expression ]

1. 抓取源地址为192.168.111.134 的数据包

root@kali:~# tcpdump -i eth0 -c 1 -vnn ip src host 192.168.111.134
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:25:12.846317 IP (tos 0x0, ttl 128, id 1868, offset 0, flags [none], proto ICMP (1), length 60)
    192.168.111.134 > 192.168.111.133: ICMP echo request, id 1, seq 37, length 40
1 packet captured
1 packet received by filter
0 packets dropped by kernel

2.抓取目标地址为192.168.111.134 的数据包

root@kali:~# tcpdump -i eth0 -c 1 -vnn ip dst host 192.168.111.134
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:26:42.178989 IP (tos 0x0, ttl 64, id 16190, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.111.133 > 192.168.111.134: ICMP echo request, id 2720, seq 1, length 64
1 packet captured
1 packet received by filter
0 packets dropped by kernel

3.抓取地址为192.168.111.134 的数据包

root@kali:~# tcpdump -i eth0 -c 2 -vnn ip host 192.168.111.134
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:29:02.069250 IP (tos 0x0, ttl 64, id 32390, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.111.133 > 192.168.111.134: ICMP echo request, id 2720, seq 140, length 64
02:29:02.069948 IP (