使用tcpdump抓包和简单的命令

1:安装tcpdump

yum install -y tcpdump

 

2:监控某一个网卡的流量

[root@dg-master ~]# tcpdump -i eth0

11:26:33.987299 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1496840:1497116, ack 937, win 141, length 276

11:26:33.987599 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 1497116, win 521, length 0

11:26:33.987840 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497116:1497392, ack 937, win 141, length 276

11:26:33.988530 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497392:1497572, ack 937, win 141, length 180

11:26:33.988814 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497572:1497752, ack 937, win 141, length 180

11:26:33.988934 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 1497572, win 519, length 0

11:26:33.989025 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1497752:1498028, ack 937, win 141, length 276

11:26:33.989101 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 1498028:1498208, ack 937, win 141, length 180

 

3:指定监控ip

tcpdump host 192.168.100.142

11:58:25.783219 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 464208, win 524, length 0

11:58:25.783475 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464208:464612, ack 261, win 141, length 404

11:58:25.784555 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464612:464776, ack 261, win 141, length 164

11:58:25.784765 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 464776:464940, ack 261, win 141, length 164

11:58:25.784907 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [.], ack 464776, win 522, length 0

11:58:25.78511:58:25.823012 IP 192.168.100.100.ssh > 192.168.100.142.56903: Flags [P.], seq 477096:477372, ack 261, win 141, length 276

11:58:25.823156 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [P.], seq 261:313, ack 477096, win 522, length 52

11:58:25.823237 IP 192.168.100.142.56903 > 192.168.100.100.ssh: Flags [P.], seq 313:365, ack 477372, win 521, length 52

 

4:截取本机和指定ip的之间的通讯(和监控ip一样)

tcpdump -n -i eth0 host 192.168.100.100 and 192.168.100.142

 

5:监控进入本机的包

tcpdump -n -i eth0 dst 192.168.100.100

 

6:监控从本机出去的包

tcpdump -n -i eth0 src 192.168.100.100

 

7:过滤信息

使用andor的组合

tcpdump -n -i eth0 src 192.168.100.100 or 192.168.100.142

tcpdump -n -i eth0 src 192.168.100.100 or 192.168.100.142 and port ! 22 and tcp

发布了64 篇原创文章 · 获赞 50 · 访问量 24万+
展开阅读全文

没有更多推荐了,返回首页

©️2019 CSDN 皮肤主题: 大白 设计师: CSDN官方博客

分享到微信朋友圈

×

扫一扫,手机浏览