tcpdump命令

tcpdump 可以输出为每个 NIC 捕获的数据包的 Header。tcpdump 的一个重要区别是，与 iptrace 不同，它一次只能查看一个网络接口。而且，因为 iptrace 将检查来自内核空间的完整的数据包，所以其结果可能导致丢弃大量的数据包。使用 tcpdump，您还可以限制要跟踪的数据的总量。另外，您不需要使用 ipreport 类型的命令来格式化二进制的数据，因为 tcpdump 将进行跟踪并产生格式化的输出。下面给出了一个示例。

-in
Name  Mtu   Network     Address            Ipkts Ierrs    Opkts Oerrs  Coll
en0   1500  link#2      e4.1f.13.4f.d9.5a  1326010     0   688318     3     0
en0   1500  10.200.44   10.200.44.9        1326010     0   688318     3     0

host 10.1.112.174  #/显示所有从主机10.1.112.174接收与发送的包/#
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on en0, link-type 1, capture size 96 bytes
09:53:44.297429 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 442760630 win 16384
09:53:44.297447 IP P5504PT.telnet > 10.1.112.174.50782: P 1:131(130) ack 0 win 65535
09:53:44.498404 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 131 win 16254
09:53:44.498436 IP P5504PT.telnet > 10.1.112.174.50782: P 131:300(169) ack 0 win 65535
09:53:44.709469 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 300 win 16085
09:53:44.709504 IP P5504PT.telnet > 10.1.112.174.50782: P 300:465(165) ack 0 win 65535
09:53:44.910442 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 465 win 15920
09:53:44.910467 IP P5504PT.telnet > 10.1.112.174.50782: P 465:630(165) ack 0 win 65535
09:53:45.111513 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 630 win 15755
09:53:45.111532 IP P5504PT.telnet > 10.1.112.174.50782: P 630:795(165) ack 0 win 65535
09:53:45.312493 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 795 win 15590
09:53:45.312514 IP P5504PT.telnet > 10.1.112.174.50782: P 795:960(165) ack 0 win 65535
09:53:45.513565 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 960 win 15425
09:53:45.513592 IP P5504PT.telnet > 10.1.112.174.50782: P 960:1125(165) ack 0 win 65535
09:53:45.714553 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 1125 win 15260
09:53:45.714596 IP P5504PT.telnet > 10.1.112.174.50782: P 1125:1291(166) ack 0 win 65535
09:53:45.915521 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 1291 win 15094
09:53:45.915554 IP P5504PT.telnet > 10.1.112.174.50782: P 1291:1459(168) ack 0 win 65535
09:53:46.116595 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 1459 win 14926
09:53:46.116621 IP P5504PT.telnet > 10.1.112.174.50782: P 1459:1627(168) ack 0 win 65535
09:53:46.317568 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 1627 win 16384
09:53:46.317591 IP P5504PT.telnet > 10.1.112.174.50782: P 1627:1795(168) ack 0 win 65535
09:53:46.518543 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 1795 win 16216
09:53:46.518564 IP P5504PT.telnet > 10.1.112.174.50782: P 1795:1963(168) ack 0 win 65535
09:53:46.729605 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 1963 win 16048
09:53:46.729632 IP P5504PT.telnet > 10.1.112.174.50782: P 1963:2131(168) ack 0 win 65535
09:53:46.930590 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 2131 win 15880
09:53:46.930634 IP P5504PT.telnet > 10.1.112.174.50782: P 2131:2299(168) ack 0 win 65535
09:53:47.046199 IP 10.1.112.174.50782 > P5504PT.telnet: P 0:1(1) ack 2299 win 15712
^C
176 packets received by filter
0 packets dropped by kernel

-w tcpdump.out   #/dump保存到tcpdump.out文件.
tcpdump: listening on en0, link-type 1, capture size 96 bytes
^C                                         #/Ctrl+C 中断
18 packets received by filter
0 packets dropped by kernel          #/输出说明内核并没有丢弃任何数据包,这是很好的情况。

-r tcpdump.out  #/读取dump文件.
reading from file tcpdump.out, link-type 1
10:09:11.364943 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 442862583 win 14960
10:09:11.364968 IP P5504PT.telnet > 10.1.112.174.50782: P 1:64(63) ack 0 win 65535
10:09:11.564914 IP 10.1.112.174.50782 > P5504PT.telnet: . ack 64 win 16384
10:09:11.733442 arp who-has 10.200.44.64 (Broadcast) tell 10.200.44.241
10:09:11.782660 IP 10.200.44.243.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=standby group=44 addr=10.200.44.254
10:09:11.783660 IP 10.200.44.241.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=active group=44 addr=10.200.44.254
10:09:11.955883 arp who-has 10.200.44.64 (Broadcast) tell 10.200.44.243
10:09:12.224256 IP 10.200.44.73.61051 > 10.200.44.255.xmquery: udp 92
10:09:12.284066 IP P5504PT.telnet > 10.193.71.88.pammratc: P 233213554:233213686(132) ack 3955617800 win 65535
10:09:12.407357 IP P5504PT.telnet > 10.193.71.30.servexec: P 1322681430:1322681529(99) ack 2012168127 win 65535
10:09:12.429922 IP 10.193.71.88.pammratc > P5504PT.telnet: . ack 132 win 64909
10:09:12.429960 IP P5504PT.telnet > 10.193.71.88.pammratc: P 132:468(336) ack 1 win 65535
10:09:12.561238 IP P5504PT.telnet > 10.193.71.88.shockwave: P 3945028010:3945028105(95) ack 3241344033 win 65535
10:09:12.583332 IP 10.193.71.30.servexec > P5504PT.telnet: . ack 99 win 64384
10:09:12.632090 IP 10.193.71.88.pammratc > P5504PT.telnet: . ack 468 win 64573
10:09:12.731734 IP 10.193.71.88.shockwave > P5504PT.telnet: . ack 95 win 65535
10:09:13.594141 IP 10.1.112.174.50782 > P5504PT.telnet: P 0:1(1) ack 64 win 16384
#