1:安装tcpdump
yum install -y tcpdump
2:监控某一个网卡的流量
[root@dg-master ~]# tcpdump -i eth0
11:26:33.987299 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1496840:1497116, ack 937, win 141, length 276
11:26:33.987599 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 1497116, win 521, length 0
11:26:33.987840 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497116:1497392, ack 937, win 141, length 276
11:26:33.988530 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497392:1497572, ack 937, win 141, length 180
11:26:33.988814 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497572:1497752, ack 937, win 141, length 180
11:26:33.988934 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 1497572, win 519, length 0
11:26:33.989025 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497752:1498028, ack 937, win 141, length 276
11:26:33.989101 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1498028:1498208, ack 937, win 141, length 180
3:指定监控ip
tcpdump host 192.168.100.142
11:58:25.783219 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 464208, win 524, length 0
11:58:25.783475 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464208:464612, ack 261, win 141, length 404
11:58:25.784555 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464612:464776, ack 261, win 141, length 164
11:58:25.784765 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464776:464940, ack 261, win 141, length 164
11:58:25.784907 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 464776, win 522, length 0
11:58:25.78511:58:25.823012 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 477096:477372, ack 261, win 141, length 276
11:58:25.823156 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [P.], seq 261:313, ack 477096, win 522, length 52
11:58:25.823237 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [P.], seq 313:365, ack 477372, win 521, length 52
4:截取本机和指定ip的之间的通讯(和监控ip一样)
tcpdump -n -i eth0 host 192.168.100.100 and 192.168.100.142
5:监控进入本机的包
tcpdump -n -i eth0 dst 192.168.100.100
6:监控从本机出去的包
tcpdump -n -i eth0 src 192.168.100.100
7:过滤信息
使用and和or的组合
tcpdump -n -i eth0 src 192.168.100.100 or 192.168.100.142
tcpdump -n -i eth0 src 192.168.100.100 or 192.168.100.142 and port ! 22 and tcp