linux简单的数据包捕获分析

有时我们会遇到一些问题，需要捕捉数据包分析，当手头有没有专业的抓图工具，您可以使用tcpdump相反，看看（一般版本附带这个工具）

比如，我们要分析eth0与接口192.168.7.188 这个对象IP住址22port该合同的情况

tcpdump -i eth0 dst 192.168.7.188 and port 22

tcpdump -i eth0 dst 192.168.7.188 and port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:51:55.861670 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 2209699250:2209699442, ack 582840950, win 249, options [nop,nop,TS val 428468844 ecr 517889], length 192
16:51:55.868590 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 192:416, ack 1, win 249, options [nop,nop,TS val 428468851 ecr 517897], length 224
16:51:55.870577 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 416:624, ack 1, win 249, options [nop,nop,TS val 428468853 ecr 517899], length 208
16:51:55.872602 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 624:832, ack 1, win 249, options [nop,nop,TS val 428468855 ecr 517899], length 208
16:51:55.874576 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 832:1040, ack 1, win 249, options [nop,nop,TS val 428468857 ecr 517900], length 208
16:51:55.876573 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1040:1248, ack 1, win 249, options [nop,nop,TS val 428468859 ecr 517900], length 208
16:51:55.878574 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1248:1456, ack 1, win 249, options [nop,nop,TS val 428468861 ecr 517901], length 208
16:51:55.880574 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1456:1664, ack 1, win 249, options [nop,nop,TS val 428468863 ecr 517901], length 208

版权声明：本文博主原创文章，博客，未经同意不得转载。

转载于:https://www.cnblogs.com/mengfanrong/p/4791970.html