Linux tcpdump

环境

• OS: Red Hat Enterprise Linux Server release 6.5 (Santiago)
• tcpdump version 4.1-PRE-CVS_2012_02_01
• libpcap version 1.4.0

描述

NAME
tcpdump - dump traffic on a network
DESCRIPTION
Tcpdump prints out a description of the contents of packets on a network interface that match the boolean expression. It can also be run with the -w
flag, which causes it to save the packet data to a file for later analysis, and/or with the -r flag, which causes it to read from a saved packet file
rather than to read packets from a network interface. In all cases, only packets that match expression will be processed by tcpdump.

示例

   To print all packets arriving at or departing from sundown:
          tcpdump host sundown

   To print traffic between helios and either hot or ace:
          tcpdump host helios and \( hot or ace \)

   To print all IP packets between ace and any host except helios:
          tcpdump ip host ace and not helios

   To print all traffic between local hosts and hosts at Berkeley:
          tcpdump net ucb-ether

   To  print  all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell from (mis-)interpreting the parenthe-
   ses):
          tcpdump 'gateway snup and (port ftp or ftp-data)'

   To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make  it  onto  your  local
   net).
          tcpdump ip and not net localnet

   To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
          tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

   To  print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only pack-
   ets.  (IPv6 is left as an exercise for the reader.)
          tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

   To print IP packets longer than 576 bytes sent through gateway snup:
          tcpdump 'gateway snup and ip[2:2] > 576'

   To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
          tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'

   To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):
          tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'

参数

[root@app72 logs]# tcpdump --help
Usage: tcpdump [-aAdDefIKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
[ -i interface ] [ -M secret ] [ -r file ]
[ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ]
[ -y datalinktype ] [ -z command ] [ -Z user ]
[ expression ]

参考

man tcpdump