一、tcpdump 抓包常用参数
二、tcpdump 输出常用参数
三、表达式
表达式用于筛选输出哪些类型的数据包，如果没有给定表达式，所有的数据包都将输出。
表达式由一个或多个表达元组成（表达元：组成表达式的基本元素）。
一个表达元通常由一个或多个修饰符，后跟一个名字或数字组成。
有三种不同类型的修饰符：type，dir以及proto。
四、示例
1. 抓取指定网卡数据包
不指定网卡默认是第一个
root@test-physical:~# tcpdump -i eth2
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
09:49:32.521925 IP 172.16.245.1 > 172.16.245.153: ICMP echo request, id 62819, seq 0, length 64
09:49:32.521942 IP 172.16.245.153 > 172.16.245.1: ICMP echo reply, id 62819, seq 0, length 64
2. 抓取指定 host 的数据包
root@test-physical:~# tcpdump host 172.16.245.1
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:24:39.166981 IP 172.16.245.145.ssh > 172.16.245.1.62592: Flags [P.], seq 2121937010:2121937198, ack 564783646, win 315, options [nop,nop,TS val 297485967 ecr 2044646503], length 188
14:24:39.167281 IP 172.16.245.1.62592 > 172.16.245.145.ssh: Flags [.], ack 188, win 2045, options [nop,nop,TS val 2044646913 ecr 297485967], length 0
3. 抓取 hostA 和 hostB 之间或 hostA 和 hostC 之间的通讯
tcpdump host hostA and \(hostB or hostC \)
root@test-physical:~# tcpdump host 172.16.245.1 and \(172.16.245.145 or 172.16.245.146\)
4. 抓取 hostA 与所有主机之间的通讯，但是不包括 hostB
tcpdump ip host hostA and not hostB
root@test-physical:~# tcpdump ip host 172.16.245.1 and not 172.16.245.145
5. 抓取指定源地址或 IP 的数据包
tcpdump src host hostname
抓取源地址是 baidu.com 的数据包
root@test-physical:~# tcpdump src host baidu.com
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:46:33.484762 IP 220.181.38.148 > 172.16.245.153: ICMP echo reply, id 38286, seq 1, length 64
14:46:34.487862 IP 220.181.38.148 > 172.16.245.153: ICMP echo reply, id 38286, seq 2, length 64
14:46:35.491003 IP 220.181.38.148 > 172.16.245.153: ICMP echo reply, id 38286, seq 3, length 64
6. 抓取指定目标地址或 IP 的数据包
tcpdump dst host hostname
抓取目标地址是 baidu.com 的数据包
root@test-physical:~# tcpdump dst host baidu.com
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:41:32.028922 IP 172.16.245.153 > 220.181.38.148: ICMP echo request, id 38241, seq 1, length 64
14:41:33.030989 IP 172.16.245.153 > 220.181.38.148: ICMP echo request, id 38241, seq 2, length 64
14:41:34.034075 IP 172.16.245.153 > 220.181.38.148: ICMP echo request, id 38241, seq 3, length 64
7. 抓取指定端口和主机的数据包
tcpdump tcp port portNumber and host hostname
root@test-physical:~# tcpdump -i eth0 port 80 and host www.baidu.com
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:00:55.976759 IP 192.168.50.145.51677 > 61.135.169.121.443: Flags [F.], seq 3695524080, ack 157044170, win 4096, length 0
15:00:55.976789 IP 192.168.50.145.51676 > 61.135.169.125.443: Flags [F.], seq 1010083189, ack 1311922281, win 4096, length 0
15:00:55.976822 IP 192.168.50.145.51675 > 61.135.169.121.443: Flags [F.], seq 1355311995, ack 556334558, win 4096, length 0
8. 抓取指定网络的数据包
tcpdump -c count net netIP
抓取本机与 172.16 网段通信的 10 个数据包
root@test-physical:~# tcpdump -c 10 net 172.16
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:03:54.887095 IP 172.16.245.145.ssh > 172.16.245.1.62592: Flags [P.], seq 2240238270:2240238458, ack 564887890, win 315, options [nop,nop,TS val 298074897 ecr 2046987344], length 188
15:03:54.887189 IP 172.16.245.1.62592 > 172.16.245.145.ssh: Flags [.], ack 188, win 2045, options [nop,nop,TS val 2046987853 ecr 298074897], length 0
15:03:54.887510 IP 172.16.245.153.42352 > public1.114dns.com.domain: 52224+ PTR? 1.245.16.172.in-addr.arpa. (43)
15:03:55.322557 ARP, Request who-has 172.16.245.153 tell 172.16.245.2, length 46
15:03:55.322578 ARP, Reply 172.16.245.153 is-at 00:0c:29:4b:87:05 (oui Unknown), length 28
15:03:55.322652 IP 118.144.77.165.4506 > 172.16.245.153.54822: Flags [R.], seq 3084328717, ack 449394572, win 64240, length 0
15:03:57.577262 IP 172.16.245.1 > 172.16.245.145: ICMP echo request, id 14029, seq 0, length 64
15:04:14.911573 IP 172.16.245.145.ssh > 172.16.245.1.62592: Flags [P.], seq 188:560, ack 1, win 315, options [nop,nop,TS val 298079903 ecr 2046987853], length 372
15:04:14.911641 IP 172.16.245.153.38782 > public1.114dns.com.domain: 28450+ PTR? 114.114.114.114.in-addr.arpa. (46)
15:04:24.940290 IP 172.16.245.145.ssh > 172.16.245.1.62592: Flags [P.], seq 560:708, ack 1, win 315, options [nop,nop,TS val 298082410 ecr 2047007856], length 148
10 packets captured
37 packets received by filter
25 packets dropped by kernel
9. 抓取 ICMP 包。ping包
tcpdump -i networkCard icmp
root@test-physical:~# tcpdump -i eth0 icmp
指定某主机对本机的 ping 包
root@test-physical:~# tcpdump -i eth0 icmp and src 172.16.245.145
10. 抓包并保存到指定文件
tcpdump -i networkCard -c count -w filePath
抓取的数据包保存到 /var/log/tcpdump.log 文件中，当抓取100个数据包后就退出程序
root@test-physical:~# tcpdump -i eth0 -c 100 -w /var/log/tcpdump.log
11. 读取抓包保存文件
tcpdump -i networkCard -r filePath
从/var/log/tcpdump.log 中读取 tcp 协议的数据包
root@test-physical:~# tcpdump -i eth0 -r /var/log/tcpdump.log
读取文件中 host 是 172.16.245.145 的数据包
root@test-physical:~# tcpdump -i eth0 -r /var/log/tcpdump.logl host 172.16.245.145
12. 抓取多播并数据包
tcpdump -i networkCard ether multicast
root@test-physical:~# tcpdump -i ech0 ether multicast
13.解析数据包
root@test-physical:~# tcpdump -c 2 -q -XX -vvv -nn -i eth0 tcp dst port 22
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:10:54.514308 IP (tos 0x48, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
172.16.245.1.62592 > 172.16.245.145.22: tcp 0
0x0000: 000c 294b 8705 0050 56c0 0008 0800 4548 ..)K...PV.....EH
0x0010: 0034 0000 4000 4006 f7c7 ac10 f501 ac10 .4..@.@.........
0x0020: f591 f480 0016 21ab 8aae 8587 68d2 8010 ......!.....h...
0x0030: 07fe 4049 0000 0101 080a 7a08 f3cc 11c5 ..@I......z.....
0x0040: dcdc ..
15:10:54.514643 IP (tos 0x48, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
172.16.245.1.62592 > 172.16.245.145.22: tcp 0
0x0000: 000c 294b 8705 0050 56c0 0008 0800 4548 ..)K...PV.....EH
0x0010: 0034 0000 4000 4006 f7c7 ac10 f501 ac10 .4..@.@.........
0x0020: f591 f480 0016 21ab 8aae 8587 6ad6 8010 ......!.....j...
0x0030: 07f7 3e4c 0000 0101 080a 7a08 f3cc 11c5 ..>L......z.....
0x0040: dcdc ..
2 packets captured
2 packets received by filter
0 packets dropped by kernel
作者：河码匠
链接：https://www.jianshu.com/p/97bc950e36d5
来源：简书