tcpdump 监测网络包,类似于 sniffer, netxray, ethereal
tcpdump -c 8收到8个packet 就退出程序tcpdump -a将ip地址转换成为域名tcpdump -d -dd -ddd将packet-matching code 显示然后退出什么是packet-matching code
- d 方便于人阅读的格式 (000) ret #96
- dd 用C语言的格式 { 0x6, 0, 0, 0x00000060 },
- ddd 用十进制数字的格式 1 6 0 0 96
-e显示链路层的包头信息-E解密包头 <pre> Use algo:secret for decrypting IPsec ESP packets algorithms :des-cbc default 3des-cbc blowfish-cbc rc3-cbc cast128-cbc </pre> secret 是ESP secrte key密钥
例如
tcpdump -E 3des-cbc:aaa
-i选择监视的网络接口
tcpdump -i eth1
如果有两个以上的网卡的时候会有用的.
tcpdump -i lo
监视loopback
tcpdump -i any
linux 2.2 以上的版本支持any 网络接口. 指所有的接口,包括loopback
-l让标准输出是行缓冲.tcpdump -l > some.data此时tcpdump的标准输出不是行缓冲的. 所以再用
tail -f some.data命令也不会立即看到结果.使用行缓冲后,就可以立即看到了.-n不使用主机域名解析-nn不使用协议和端口的名称解析-N不使用完整的域名.host.domain.com 只显示host而不是host.domain.com-m装载SMI MIB 模块-q只是简短的显示一些协议信息-r从文件中读包(packet),-w向文件中写入(packet).-S显示绝对的TCP序列号(Sequence Number),而不是相对的.-t不显示Time stamp-tt显示没有格式的Time Stamp,eg. 1046592706.056390-ttt显示两个报之间的时间差
ex:
000040 毫秒
998670 毫秒
2.494458 秒
-tttt用缺省的格式显示Time Stamp,
03/02/2003 08:17:41.336789
mm/dd/yyyy hh:mm:ss.ms
时间好像不是本地时间
如果没有指定
-t -tt -ttt -tttt, 格式是
16:17:25.076892 hh:mm:ss.ms
-T把抓到的包(packet),经过expressiong 过滤后,认为是某种特别的类型.
ex: tcpdump -T cnfp <some filter expression>
支持的类型有:
- cnfp(Cisco <nop>NetFlow</nop> Protocol)
- rpc ( Remote Procedure Call),
- rtp ( Real-Time protocal)
- snmp( Simple Network Management Protocol)
- vat ( Visual Audio Tool)
- wb ( distributed White Board)
-v多一些显示信息,如IP的选项.检查IP ICMP 校验和.SMB Packets-vv-vvv更多的信息-x显示包的内容,用十六进制显示,不包括链路层的
16:59:06.807010 ann.home.com.cn > ns.home.com.cn: icmp: echo request (DF)
4500 0054 0000 4000 4001 2926 c0a8 c81f
c0a8 c812 0800 d98e aa03 0100 f3c8 613e
2763 0c00 0809 0a0b 0c0d 0e0f 1011 1213
1415 1617 1819 1a1b 1c1d 1e1f 2021 2223
2425 2627 2829 2a2b 2c2d 2e2f 3031 3233
3435
16:59:06.807073 ns.home.com.cn > ann.home.com.cn: icmp: echo reply
4500 0054 49cc 0000 4001 1f5a c0a8 c812
c0a8 c81f 0000 e18e aa03 0100 f3c8 613e
2763 0c00 0809 0a0b 0c0d 0e0f 1011 1213
1415 1617 1819 1a1b 1c1d 1e1f 2021 2223
2425 2627 2829 2a2b 2c2d 2e2f 3031 3233
3435
-X显示包的内容,用十六进制显示,同时显示ACCSI,不包括链路层的
16:59:38.706971 ann.home.com.cn > ns.home.com.cn: icmp: echo request (DF) 0x0000 4500 0054 0000 4000 4001 2926 c0a8 c81f E..T..@.@.)&.... 0x0010 c0a8 c812 0800 18f8 ab03 0100 13c9 613e ..............a> 0x0020 c8f9 0a00 0809 0a0b 0c0d 0e0f 1011 1213 ................ 0x0030 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 .............!"# 0x0040 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 $%&'()*+,-./0123 0x0050 3435 45 16:59:38.707026 ns.home.com.cn > ann.home.com.cn: icmp: echo reply 0x0000 4500 0054 49cd 0000 4001 1f59 c0a8 c812 E..TI...@..Y.... 0x0010 c0a8 c81f 0000 20f8 ab03 0100 13c9 613e ..............a> 0x0020 c8f9 0a00 0809 0a0b 0c0d 0e0f 1011 1213 ................ 0x0030 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 .............!"# 0x0040 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 $%&'()*+,-./0123 0x0050 3435 45
过滤器表达式(expression)
Expression 由一或者多个原语(primitives)组成. Primitive 由一个id(名称或者数字),前面加一个或者多个修饰词(Qulifiers)构成 有三种不同的Qualifiers
-
类型
-
说明id是指哪种意思. 类型可以是host,net port
如 "host foo", 'net 128.3', 'port 20' 没有指定类型的时候,缺省类型是host
方向
-
说明传输的方向.
有四种可能的值 src,dst,src and dst, src or dst 如果没有指定方向 src or dst 是缺省的值 如: src foo, dst net 128.3, src or dst port ftp-data
协议
-
说明协议的名称 ether,fddi,tr,ip,ip6,arp,rarp,decnet,tcp,udp
如 'ether src foo' 如果没有指定协议,所有的协议都满足Expression
其他
- 除了以上的Primitive,还有gateway,broadcast,less greadter arithmetic,他们有特殊的格式.
可以使用and,or,not 联接Primitive 组成Expression, 如果Primitive 的Qualifier 相同,可以忽略Qualifier. 如
tcp dst port ftp or ftp-data or domain
和
tcp dst port ftp or tcp dst port ftp-data or dst port domain
是相同的意思
- IPv4/IPv6中目的地址是hostname, 可以是IP地址或者主机名称,要使用完整的域名
dst host hostname
- IPv4/IPv6中源地址是hostname, 可以是IP地址或者主机名称
- IPV4/v6中的目的地址或者源地址是host 可以在host 前面加ip,arp,rarp,ip6
- ehost 或者在/etc/ethers 中有记录,或者是48bit MAC 地址的形式
src host hostname
host hostname
ether dst ehost , ether src ehost , ether ehost
ether dst 00:00:e2:34:11:13
/etc/ethers 中的内容是
00:00:e2:34:11:13 HostName
其中 Hostname 是一个有效的主机名称, 或者在/etc/hosts中有记录,或者是域名
-
用来监测通过host作为网关的Packet. host 的名字一定要在/etc/ethers中有记录
- netname 或者在/etc/networks 中有记录或者是 192.168.200.0/24 前面是网络地址,后面/24 表示子网掩码的连1长度 /etc/ethers的内容是
dst net netname,src net netname,net netname
gateway host
NetworkName 192.168.200.0/24
-
src port portnumber,dst port portnumber, port portnumber
- portnumber 可以是数字或者是/etc/services中指定的端口名称 less length,greater lenght
- Packet 的长度不大于和不小于length 如
less 100 greater 50
- ip proto protocol,ip6 proto protocol,ip6 protochain protocol:: protocol的值可以是数字,或者是 icmp,icmp6,igmp,igrp,pim,ah,esp,udp,tcp. 注意tcp,udp,icmp也是关键字,所以使用的时候前面加一个\
后面的有点乱,以后再整理
ether broadcast,ether multicast,ip multicast,ip6 multicast,ether proto protocol::
protocol can be a number or one of the names:ip,ip6,arp,rarp,
note:
these words must be escaped via backsslash
decnet src host,decnet dst host, decnet host host::
I don't care
ip,ip6,arp,rarp,atalk,aarp,decnet,iso
abbreviations for
ether proto p
where p is one of the above protocols
vlan [vlan_id
if [vlan_id] is specified, only true is the packet has the
specified vlan_id.
tcp,udp,icmp
Abbreviations for
ip proto p or ip6 proto p
where p is one of the above protocols.
iso proto protocol
protocol: clnp,esis, isis
expr relop expr
relop can be:
<,>,<=,>=,=,!=
Note: when using a shell, please quote the above
operator, especially for the >,<,>=,<=
expr can be :
1: an arithmetic expression,(expressed in standard C
syntax),
2.the normal binary operators[+,-,*,/,|,&],
3.length operator
keyword len
ex: len = 45
4.packet data accessors.
proto[expr:size]
proto can be :
ether,fddi,tr,ip,arp,rarp,tcp,udp,icmp,ip6
expr: index of the packet data of specified protocol
size: 1,2,or 4,default 1
ex:
ether[0] &1 !=0
all multicast traffic
ip[0] &0xf !=5
all IP packets with options.
ip[6:2] &x1fff = 0
only unfragmented datagrams and frag zero of
fragmented dategrams.
Primitives may be combined using:
! or not
&& or and
|| or or
OUTPUT FORMAT
Protocol dependent.
Link Level Header ( with -e options)
21:35:08.146542 0:0:0:0:0:0 0:0:0:0:0:0 ip 98: localhost > localhost: icmp: echo request (DF)
timestamp,src.ether.address,dst.ether.address,protocol, packet length
FDDI
frame control field,source addr,dest addr,packet length.
TokenRing??
access control, frame control,source addr,dest addr,packet length.
SLIP
a direction indicator(I for inbound, O for outband)
packet type,compression information.
packet type is printed first, can be ip,utcp,ctcp. no further ip
information.
Arp
arp who-has csam tel rtsg
arp reply csam is-at CSAM
real example:
arp who-has 128.3.254.6 tell 128.3.254.68
arp reply 128.3.254.6 is-at 02:07:01:00:01:c4
with -e option
RTSG Broadcast 0806 64: arp who-has csam tell rtsg
CSAM RTSG 0806 64: arp reply csam is-at CSAM
TCP Packets
src > dst: flags data-seqno ack window urgent options
Src and dst are the source and destination IP addresses and ports.
Flags: S(SYN),F(FIN),P(PUSH),R(RST),or "."
Data-seqno: sequence number;
ack: is a sequence number of the next data expected the other
direction on this connection.
window: is hte number of bytes of receive buffer space available the
oterh direction on this connection.
Urg: indicate there is a urgent data in the packet.
options: tcp options enclosed in angle brackets
rtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
explain:>>>tcp port 1023 on rtsg sent a packet to port
login on scam.
S mean than SYN flag was set.
the seqeunce number was 768512, it contained no data.
(first:last(nbytes)' mean `sequence numbers first up to but not
including last which is nbyes bytes of user data'
csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
explain:>>> casm replies with a similar packet except it includes a
piggy-backed ack for rtsg's SYN.
rtsg.1023 > csam.login: . ack 1 win 4096
explain:>>> rtsg asks casm's SYN.
. mean there is no flag
there is no date, so no sequence number.
ack sequence number is a small integer 1,the first time tcpdump
sees a tcp conversation, it prints the sequence number from the
packet. On the subsequent packets of the conversation, the
differrence between the current packet's sequence number and
this initial sequence number is printed. This means that
sequence numbers after the first can be interpreted as relative
byte positions in the conversation's data stream.(with the
firest data byte each direction beging `1'.
'-S' options, will override this feathure.
rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
explain:>>>
csam.login > rtsg.1023: . ack 2 win 4096
rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1
转载于:https://blog.51cto.com/cnhotfire/739175
909
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
