mac安装wireshark,tcpdump， 如何解决抓不到包的问题

http://blog.csdn.net/thundon/article/details/43673393

brew install wireshark --with-qt

brew reinstall wireshark --with-qt

现在的wireshark，运行时不需要加-qt。

直接命令行执行，就可以出来可视化界面。

mac真的烂，最终linux服务器可以抓到数据包的命令：

sudo tcpdump  -n  -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

其中 -n 很霸气， http过滤语句还没有搞懂

参考：

https://www.cnblogs.com/sidesky/p/5230925.html

There are tcpdump filters for HTTP GET & HTTP POST (or for both plus message body):

• Run man tcpdump | less -Ip examples to see some examples

• Here’s a tcpdump filter for HTTP GET:

  sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

• Here’s a tcpdump filter for HTTP POST:

  sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

• Monitor HTTP traffic including request and response headers and message body (source):

  tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' tcpdump -X -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

参考：

http://lin-style.iteye.com/blog/193441