Android编译tcpdump,Android tcpdump TCP 抓包

0x01 概述

本文将介绍安卓模拟器环境下面使用tcpdump抓包的方法，适合小白用户查看。

0x02 安装指南

2.1 环境信息

笔记本: MacBook Pro 2020款 13寸

MacOS: 10.15.5

模拟器: 网易Mumu 1.9.15，已开启root权限

Wireshark: 3.2.4

2.2 安装脚本#!/bin/bash

shell_script_path=$(cd `dirname $0`; pwd)

tcpdump_local_path="${shell_script_path}/tcpdump"

if [ ! -f "${tcpdump_local_path}" ]; then

cd ${shell_script_path}

curl -O http://www.androidtcpdump.com/download/4.9.0/tcpdump

echo -e "download tcpdump at path ${shell_script_path}"

fi

if [ -f "${tcpdump_local_path}" ]; then

echo -e "findout tcpdump ${tcpdump_local_path}"

else

echo -e "download tcpdump fail"

exit 1

fi

adb push "${tcpdump_local_path}" /data/local/tcpdump

adb shell chmod 6755 /data/local/tcpdump

echo -e "install tcpdump success"

echo -e "You can use like

adb shell as root!

cd /data/local/

./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

Then exit shell

adb pull /sdcard/capture.pcap .

"

echo -e "Do you want delete tcpdump file (y) ?"

read isDeleteDownload

if [ ${isDeleteDownload} == "y" ]; then

rm -f ${tcpdump_local_path}

echo -e "success remove ${tcpdump_local_path}"

fi

2.3 手动安装

1、tcpdump for android 在这里下载：

点我下载tcpdump

2、使用adb push命令将tcpdump上传到安卓模拟器中，然后添加执行权限adb push ~/Downloads/tcpdump /data/local/tcpdump

adb shell chmod 6755 /data/local/tcpdump

0x03 操作指南

tcpdump 需要在命令行运行目录中存在cd /data/local

./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

拉取抓获的tcp/udp包adb pull /sdcard/capture.pcap

用wireshark打开capture.pcap即可分析log

tcpdump 参数说明"-i any": listen on any network interface

"-p": disable promiscuous mode (doesn't work anyway)

"-s 0": capture the entire packet

"-w": write packets to a file (rather than printing to stdout)

... do whatever you want to capture, then ^C to stop it ...