wireshark--抓包-zb-命-tcpdump

观察http更加方便的策略

解码 tcp报文

1 copy data

####### tool

package cn.hutool.core.util;

import cn.hutool.core.exceptions.UtilException;

import java.awt.Color;
import java.math.BigInteger;
import java.nio.charset.Charset;

/**
 * 十六进制（简写为hex或下标16）在数学中是一种逢16进1的进位制，一般用数字0到9和字母A到F表示（其中:A~F即10~15）。<br>
 * 例如十进制数57，在二进制写作111001，在16进制写作39。<br>
 * 像java,c这样的语言为了区分十六进制和十进制数值,会在十六进制数的前面加上 0x,比如0x20是十进制的32,而不是十进制的20<br>
 * <p>
 * 参考：https://my.oschina.net/xinxingegeya/blog/287476
 *
 * @author Looly
 */
public class HexUtil {

 String data = "31323233360a7b2264617461223a227b5c22636f64655c223a5c22305c222c5c226d6573736167655c223a5c225c222c5c22646174615c223a5c227b5c5c5c226261747465726965735c5c5c223a7b5c5c5c22443339364454313436345c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c223130305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c223531395c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232345c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633383834393132355c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22315c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c224b4f6c744c6c6335743952735878597778782b4c39513d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532355141335c5c5c222c5c5c5c227569645c5c5c223a5c5c5c225c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2238656230663366302d343863622d343135652d386138662d3266343730343064356432625c5c5c227d2c5c5c5c22443434344552313055325c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c223130305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c225c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c22345c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232335c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633383933313433395c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22315c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c227655456c445445684e51564a504454537447424551773d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532355142345c5c5c222c5c5c5c227569645c5c5c223a5c5c5c22305c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2263616231613163332d623536642d346365362d386665342d6238363761653031653438315c5c5c227d2c5c5c5c22453039354548313853365c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c2239305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c223531395c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232345c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633393231333932315c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22315c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22343639385c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c22417630722f61302f6f5742694d736f4c586e6f5139673d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532355142315c5c5c222c5c5c5c227569645c5c5c223a5c5c5c225c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2233363733373165652d363662632d343934352d616231362d3964616531636530653235645c5c5c227d2c5c5c5c224b3235344556313631585c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c2239305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c22375c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232335c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633393334353735315c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22375c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22343639385c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c22592f5a656d69636538704331506438715777464d69673d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532395141335c5c5c222c5c5c5c227569645c5c5c223a5c5c5c225c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2234636237626338342d313131632d346436662d396463662d3636323531316331303531635c5c5c227d2c5c5c5c224b3237344547313142435c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c2239305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c22365c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232345c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633383637393338315c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22375c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22343639385c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c2277457a6f6872646a4d4355714d654f69506549744e673d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532395141315c5c5c222c5c5c5c227569645c5c5c223a5c5c5c225c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2262343166326130352d613561302d343365662d396139662d6663643863663064366364315c5c5c227d2c5c5c5c224b343133464a313242305c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c2239305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c22365c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232345c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633383639303235385c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22375c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22343639385c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c227441384362377142797030544b4e7a2f6f35704932673d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532395141375c5c5c222c5c5c5c227569645c5c5c223a5c5c5c225c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2235313466353737352d613864322d343466362d613832342d6566383336653766653431635c5c5c227d2c5c5c5c22543435334456333032315c5c5c223a7b5c5c5c22616c6976655f63617061636974795f726174655c5c5c223a5c5c5c2239305c5c5c222c5c5c5c2261736372697074696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c22617661696c61626c655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22626174746572795f7461675c5c5c223a5c5c5c223531325c5c5c222c5c5c5c22627573696e6573735f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c226368617267655f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c22637572725f74656d70657261747572655c5c5c223a5c5c5c2232345c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633383833333930305c5c5c222c5c5c5c22696e746572666163655c5c5c223a5c5c5c22365c5c5c222c5c5c5c2269735f7369785c5c5c223a5c5c5c22305c5c5c222c5c5c5c226d61685f616c6976655f63617061636974795c5c5c223a5c5c5c22353232305c5c5c222c5c5c5c226d61685f6368617267655f63617061636974795c5c5c223a5c5c5c22343639385c5c5c222c5c5c5c226f726465725f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c2270617373776f72645c5c5c223a5c5c5c227134454b653937426d44316738644d6f3667463039773d3d5c5c5c222c5c5c5c2272657475726e5f74696d655c5c5c223a5c5c5c225c5c5c222c5c5c5c22736e5c5c5c223a5c5c5c225c5c5c222c5c5c5c227374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e735f6d69645f7374617475735f74696d655c5c5c223a5c5c5c22305c5c5c222c5c5c5c227472616e73616374696f6e5f7374617475735c5c5c223a5c5c5c22315c5c5c222c5c5c5c22747970655f69645c5c5c223a5c5c5c2259313532365141345c5c5c222c5c5c5c227569645c5c5c223a5c5c5c225c5c5c222c5c5c5c227570646174655f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22757569645c5c5c223a5c5c5c2262616437643139302d343362642d343261342d393237302d3863393932613936393638335c5c5c227d7d2c5c5c5c22626174746572795f736f6674776172655f76657273696f6e5c5c5c223a5c5c5c225c5c5c222c5c5c5c2263656c6c5f706f736974696f6e5c5c5c223a5c5c5c225c5c5c222c5c5c5c226368696c6472656e5f63656c6c5c5c5c223a5c5c5c225c5c5c222c5c5c5c226368696c72656e5c5c5c223a5c5c5c225c5c5c222c5c5c5c226465766963655f69645c5c5c223a5c5c5c2231383533613830632d613764662d343762392d623039302d3332393333346665303764395c5c5c222c5c5c5c226578745f73637265656e5f69645c5c5c223a5c5c5c225c5c5c222c5c5c5c226578745f73637265656e5f76657273696f6e5c5c5c223a5c5c5c225c5c5c222c5c5c5c22696e69745f74696d655c5c5c223a5c5c5c22313633383637353634355c5c5c222c5c5c5c226c6f636174696f6e5c5c5c223a5c5c5c22e68890e983bd2de8bdafe4bbb6e59bad47e58cba5c5c5c222c5c5c5c226c6f636b5f74696d655c5c5c223a5c5c5c22313533313331343032385c5c5c222c5c5c5c226c6f636b65645c5c5c223a5c5c5c22305c5c5c222c5c5c5c226c6f6e675f6865617274626561745f74696d655c5c5c223a5c5c5c22313633393436373738395c5c5c222c5c5c5c22706172656e745c5c5c223a5c5c5c225c5c5c222c5c5c5c22706172656e745f63656c6c5c5c5c223a5c5c5c225c5c5c222c5c5c5c22706f736974696f6e5c5c5c223a5c5c5c22305c5c5c222c5c5c5c2270726f6a6563745c5c5c223a5c5c5c22315c5c5c222c5c5c5c2273686f72745f6865617274626561745f74696d655c5c5c223a5c5c5c22313633393436393431315c5c5c222c5c5c5c22736c6f745f6e756d5c5c5c223a5c5c5c2231325c5c5c222c5c5c5c22736c6f74735c5c5c223a7b5c5c5c";
        log.info("data length: {}",data.length());
        String packet = HexUtil.decodeHexStr(data);

demo

click
想要获取主机192.168.220.108接收或发出的ssh包，并且不转换主机名

sudo tcpdump -nn -n src host 192.168.220.108 and port 6666 and tcp -w /Users/wl/wl/tmp/6666_1.pack

-nn -nn，直接以 IP 及 Port Number 显示，而非主机名与服务名称

命令抓包

tcpdump tcp and src 192.168.1.1 and port 1000
tcpdump tcp or src 192.168.1.1 and port 1000

what

TCPdump—–抓包
抓包默认只抓68个字节
tcpdump -i eth0 -s 0 -w file.pcap
tcpdump -i eth0 port 22
读取抓包文件
tcpdump -r file.pcap

filter

tcpdump -n -r http.cap | awk '{print $3}'| sort -u
//-n 是不对域名做解析，只以IP地址的形式来显示
//awk '{print $3}'显示第三列的内容
//sort -u 筛选掉重复的内容

tcpdump -n src host 145.254.160.237 -r http.cap
//src来源 host 只有数据来源145.254.160.237才提取

  tcpdump -n dst host 145.254.160.237 -r http.cap
  //只有数据包是这个目标地址(distination)145.254.160.237才显示出来

 tcpdump -n port 50 -r http.cap//50端口
 tcpdump -nX port 80 -r http.cap//16进制显示80端口的信息

抓指定的网口，不限制数据报包的大小

//抓指定的网口，不限制数据报包的大小
tcpdump -i eth1 -s 0 -w /home/6006.cap
tcpdump -i eth0 tcp port 22 只抓TCP，22端口的包
sudo tcpdump -i en0 tcp port 8090 -s 0 -w /Users/wl/wl/env/1.cap
-w 直接将分组写入文件中，而不是不分析并打印出来
-i 指定监听的网络接口
-s 从每个分组中读取最开始的snaplen个字节，而不是默认的68个字节。

过滤条件：
tcp.port==80
查找目的地址为192.168.101.8的包，ip.dst==192.168.101.8；查找源地址为ip.src==1.1.1.1
tcp.srcport==80