tcpdump常用命令

抓get请求  

tcpdump -i eth3 -nnvvAs 0 'tcp[((tcp[12:1] & 0xf0) >> 2):4]=0x47455420' |grep -C15 "huochepiao_share.dat" 

tcpdump -i eth0 -nnvvAs 0 '(tcp[((tcp[12:1] & 0xf0) >> 2):4]=0x47455420) and (src host 111.11.122.8)' | grep -F "111.11.122.8"

抓http

tcpdump -nnvvAs 0 -i eth0 'tcp[((tcp[12:1] & 0xf0) >> 2):4]=0x48545450'

抓dns

tcpdump -i eth4 -vnn udp port 53 | grep "A?"

grep -Ev "(ali|dl|download|cname|taobao|tmall|ssl|https|api|login|denglu|logout|push|upload|https|ntp|timezone|pass|xunlei|pay|\:|update|akadns.net|money|ptlogin|(2[0-4][0-9]|25[0-5]|1[0-9][0-9]|[1-9]?[0-9])(\.(2[0-4][0-9]|25[0-5]|1[0-9][0-9]|[1-9]?[0-9])){3}|register|account|weibo|log|search|weather|reg|conf)" top20.txt |grep -E "(img|static|pic|image)"> aaaaaaaaaa

mtr www.baidu.com 看路由丢包情况

抓域名解析过程

tcpdump -i eth1 -nt -s 500 port domain

-n 不要把ip转换为机器名字

-vv 打印出更加详细的结果  如window, checksum等

-A 把每一个packet都用以ASCII的形式打印出来

tcpdump -nnnvvAs 0 "host 183.240.196.218" -i eth4 
tcpdump -nnnvvxxxAs 0 "host 183.240.196.218" -i eth4 
tcpdump -i p5p2 -vnn tcp port 53