tcpdump 速查表
-D 列出网络设备
~]$ sudo tcpdump -D
1.eth0
2.nflog (Linux netfilter log (NFLOG) interface)
3.nfqueue (Linux netfilter queue (NFQUEUE) interface)
4.any (Pseudo-device that captures on all interfaces)
5.lo [Loopback]
-i 指定网卡
前面列出的设备可以用 -i dev 来指定抓对应网卡的数据包
-c 指定抓包数量
~]$ sudo tcpdump -i eth0 -c 3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
03:38:41.388895 IP 13.248.125.132.37196 > ip-10-31-1-74.ap-southeast-1.compute.internal.10012: Flags [.], ack 3665636334, win 2014, options [nop,nop,TS val 1083056799 ecr 1675755283], length 0
03:38:41.389146 IP 99.82.173.66.58088 > ip-10-31-1-74.ap-southeast-1.compute.internal.10012: Flags [.], ack 978012266, win 2014, options [nop,nop,TS val 1031202901 ecr 3469957515], length 0
03:38:41.390227 IP 13.248.115.61.61524 > ip-10-31-1-74.ap-southeast-1.compute.internal.10012: Flags [P.], seq 2332145948:2332146170, ack 3523970401, win 2014, options [nop,nop,TS val 1454561556 ecr 1165926638], length 222
3 packets captured
100 packets received by filter
9 packets dropped by kernel
-n 将域名解析为 IP
~]$ sudo tcpdump -i eth0 -c 3 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
03:41:34.332790 IP 13.248.98.123.58200 > 10.31.1.74.10012: Flags [P.], seq 106251671:106251871, ack 1748469091, win 2014, options [nop,nop,TS val 1392634401 ecr 817044617], length 200
03:41:34.332957 IP 10.31.1.74.10012 > 13.248.98.121.9842: Flags [P.], seq 2880652137:2880652336, ack 1075202655, win 850, options [nop,nop,TS val 1486636778 ecr 1393164829], length 199
03:41:34.332965 IP 10.31.1.74.10012 > 13.248.98.123.58200: Flags [P.], seq 420:619, ack 200, win 613, options [nop,nop,TS val 817044728 ecr 1392634401], length 199
3 packets captured
38 packets received by filter
0 packets dropped by kernel
可以看到 ip-10-31-1-74.ap-southeast-1.compute.internal 这个域名被展示为 IP 10.31.1.74
-nn 可以将端口也展示为数字，默认情况下是会把端口展示为协议名称，例如 80 端口显示为 http。
-s 限定抓包大小（capture size）
注意，这里不是筛选包大小，而是无论数据包多大，只截取指定的长度，单位是字节（bytes）。举例一个场景，如果只想看 header，就可以只要前 64 字节长度：
~]$ sudo tcpdump -i eth0 -c 3 -s 64
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 64 bytes
03:52:13.605359 IP 13.248.125.130.61304 > ip-10-31-1-74.ap-southeast-1.compute.internal.10012: Flags [.], ack 2139160988, win 2014, options [nop,nop,TS[|tcp]>
03:52:13.609252 IP 13.248.98.123.remote-winsock > ip-10-31-1-74.ap-southeast-1.compute.internal.10012: Flags [.], ack 4105886282, win 2014, options [nop,nop,TS[|tcp]>
03:52:13.609334 IP 13.248.115.67.9258 > ip-10-31-1-74.ap-southeast-1.compute.internal.10012: Flags [.], ack 3359161493, win 2014, options [nop,nop,TS[|tcp]>
3 packets captured
49 packets received by filter
0 packets dropped by kernel
-w 另存为文件
b]$ sudo tcpdump -i eth0 -n -c 3 tcp "port 10012" -w 10012.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
3 packets captured
41 packets received by filter
0 packets dropped by kernel
另存为 .pcap 文件，可以用 WireShark 打开，也可以直接用 tcpdump -r 打开。
当然，不想用 .pcap 格式的话，直接 > capture.txt 重定向到纯文本文件也是可以的。
筛选语法
host IP 筛选主机
~]$ sudo tcpdump -i eth0 -n -c 3 "host 10.31.1.8"
src host IP 筛选源主机
~]$ sudo tcpdump -i eth0 -n -c 3 "src host 10.31.1.8"
dst host IP 筛选目标主机
~]$ sudo tcpdump -i eth0 -n -c 3 "dst host 10.31.1.8"
注意，是 dst host 不是 dest host
net CIDR 筛选网络区间
源、目标网络依次类推
~]$ sudo tcpdump -i eth0 -n -c 3 "net 10.31.0.0/16"
~]$ sudo tcpdump -i eth0 -n -c 3 "src net 10.31.0.0/16"
~]$ sudo tcpdump -i eth0 -n -c 3 "dst net 10.31.0.0/16"
port PORT 筛选端口
源、目标端口依次类推
~]$ sudo tcpdump -i eth0 -n -c 3 "port 10012"
~]$ sudo tcpdump -i eth0 -n -c 3 "src port 10012"
~]$ sudo tcpdump -i eth0 -n -c 3 "dst port 10012"
tcp udp 筛选协议
~]$ sudo tcpdump -i eth0 -nn -c 3 tcp "port 10012"
~]$ sudo tcpdump -i eth0 -n -c 3 udp
ip6 筛选 IPv6
~]$ sudo tcpdump -i eth0 -n -c 3 ip6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
06:18:17.504845 IP6 fe80::48b:8dff:fe41:c1ce.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 solicit
06:20:12.584991 IP6 fe80::48b:8dff:fe41:c1ce.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 solicit
06:22:16.652850 IP6 fe80::48b:8dff:fe41:c1ce.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 solicit
3 packets captured
49 packets received by filter
0 packets dropped by kernel
and or not 组合使用
~]$ sudo tcpdump -i eth0 -n -c 3 "src net 10.31.0.0/16 and (port 10012 or port 10013)"
参考资料
https://www.redhat.com/sysadmin/tcpdump-part-one
https://www.redhat.com/sysadmin/tcpdump-part-2
https://www.redhat.com/sysadmin/tcpdump-part-3