tcpdump是linux命令行下常用的的一个抓包工具，抓包的目的是分析问题。
tcpdump -i eth0 -nn 监听eth0，-nn表示以ip和port方式显示包，不将ip转为主机名，这种在装B的时候可以刷屏，意义不大
所以要实现更精细化的抓包还是需要加更多的参数，使用man tcpdump | less -Ip examples可以查看手册中的例子。以下是常用的例子
查看所有网卡
tcpdump -D
抓取具体协议的包
tcpdump -i eth0 -nn 'udp'
tcpdump -i eth0 -nn 'tcp'
tcpdump -i eth0 -nn 'icmp'
抓取192.168.1.233的包
tcpdump -i eth0 -nn 'host 192.168.1.233'
抓取从192.168.1.233发送的包
tcpdump -i eth0 -nn 'src host 192.168.1.233'
抓取发送到192.168.1.233的包
tcpdump -i eth0 -nn 'src host 192.168.1.233'
多种参数用and连接，如
tcpdump -i eth0 -nn 'tcp port 80 and host 192.168.1.233'
使用tcpdump截取HTTP包会很方便
tcpdump 过滤 HTTP GET
tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
tcpdump 过滤 HTTP POST
tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'
tcpdump -e 显示以太网数据帧
tcpdump -v 显示进行的分组交换
tcpdump 查看 http 响应全部报文
tcpdump -A -vvvv -s 9999 -i eth0 port 80
查看HTTP的请求和反回头和内容，详见https://sites.google.com/site/jimmyxu101/testing/use-tcpdump-to-monitor-http-traffic
tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
tcpdump -X -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
1. To monitor HTTP traffic including request and response headers and message body:
tcpdump -A -s 0 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’
2. To monitor HTTP traffic including request and response headers and message body from a particular source:
tcpdump -A -s 0 ‘src example.com and tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’
3. To monitor HTTP traffic including request and response headers and message body from local host to local host:
tcpdump -A -s 0 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’ -i lo
4. To only include HTTP requests, modify “tcp port 80” to “tcp dst port 80” in above commands
5. Capture TCP packets from local host to local host
tcpdump -i lo
tcpdump flag解读
| TCP Flag |
Flag in tcpdump |
Flag Meaning |
| SYN |
s |
Syn packet, a session establishment request. The first part of any TCP connection. |
| ACK |
ack |
Ack packet, used to acknowledge the receipt of data from the sender. May appear in conjunction with other flags. |
| FIN |
f |
Finish flag, used to indicate the sender’s intention to terminate the connection to the receiving host. |
| RESET |
r |
Indicates the sender’s intention to immediately abort the existing connection. |
| PUSH |
p |
Signals the immediate push of data from the sending host to the receiving host. For interactive applications such as telnet, the main issue is the quickest response time, which this “push” flag signals. |
| URGENT |
urg |
Urgent data should take precedence over other data. For example, a Ctrl-C to terminate a FTP download. |
| Placeholder |
0 |
If the connection does not have a syn, finish, reset, or push flag set, this placefolder flag will be found after the destination port. Note that it also appears in conjunction with the ack flag. |
tcpdump读出来的信息可以保存方便查看和分析
保存pcap信息,可以用WireShark来查看
tcpdump -i vmbr1 -nn -vv -tttt -s 65535 -w tcpdump.pcap
如果担心文件过大可以加 -C 跟数字，当文件达到这个值(MB)之后，会新生成tcpdump.pcap.2
抓取 sql 语句
tcpdump -i bond0 -s 0 -l -w - | strings | perl -e '
while(<>) { chomp; next if /^[^ ]+[ ]*$/;
if(/^(SELECT|UPDATE|DELETE|INSERT|SET|COMMIT|ROLLBACK|CREATE|DROP|ALTER|CALL)/i)
{
if (defined $q) { print "$q\n"; }
$q=$_;
} else {
$_ =~ s/^[ \t]+//; $q.=" $_";
}
}'
查看保存文件的格式
# file tcpdump.pcap
tcpdump.pcap: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535)
对于保存的文件可以用-r读取，相当于对之前的抓取的过程进行回放。
tcpdump -ttttnnr tcpdump.pcap
tcpdump -qns 0 -X -r tcpdump.pcap
tcpdump -e -r tcpdump.pcap
wireshark filter
重传
tcp.analysis.retransmission
过滤 tcp stream
tcp.stream eq 1