FreeBSD7 ipfwpcap测试：

FB7.0特色之二：ipfwpcap测试：

1、先用ipfwpcap建一个divert socket。
　　ipfwpcap -r 8888 -
     说明：（1）-r参数是让数据包再回到原来的地方。
　　　　　（2）8888是新开一个divert，用8888端口，可以随意改这个数值，但是要和后面的再对应起来。（对应的natd是8668）
　　　　　（3）“-”（减号）表示是控制台。需要注意的是，ipfwpcap是一个前台程序，最好在后面加个&号把它放到后台，或者干脆另开一个终端。

2、用ipfw把数据包传到ipfwpcap
　　ipfw add 50 divert 8888 ip from any to any
　　
　　说明：（1）正常情况，把这句尽量放早。我的例子用的是50，应该比较早了。
　　　　　（2）一定要divert 到8888，否则就到不了ipfwpcap了。

3、在ipfwpcap的终端上，就可以看到相应的信息了。

4、如果想把它保存下来分析，可以用：ipfwpcap -r 8888 /home/abc.txt。
　　这样就把原始数据以tcpdump的格式保存到/home/abc.txt。可以用tcpdump分析。

5、示例：
　　第一个终端：

QUOTE:

ipfwpcap -r 8888 /home/tcpdump

　　第二个终端：

QUOTE:

divert 8888 ip from 192.168.0.99 to any

　　
　　打开tcpdump，发现里面全是这种数据：

QUOTE:

Host: news.sina.com.cn^M
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; zh-CN; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12^M
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5^M
Accept-Language: zh-cn,zh;q=0.5^M
Accept-Encoding: gzip,deflate^M
Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7^M
Keep-Alive: 300^M
Connection: keep-alive^M
Referer: ^M
Cookie: vjlast=1205303764; sinaRotator/i=91; userId=C1eZpnT8wJPVI0PvitQV1uP4B8PG9wPu9vO6fzYvfvPvWw; SINAGLOBAL=221.2.101.123.26732119794087693
^M

　　用tcpdump分析，和tcpdump用法一样：（查看DSN信息）
　　

QUOTE:

请在文本框tcpdump -nr /home/hu/cap.txt dst port 53
reading from file /home/hu/cap.txt, link-type RAW (Raw IP)
15:05:45.931593 IP 192.168.0.99.1460 > 202.102.134.68.53: 22118+ A? zh-cn.google.mozilla.com. (42)
15:05:45.931657 IP 192.168.0.99.1460 > 202.102.134.68.53: 22118+ A? zh-cn.google.mozilla.com. (42)
15:05:46.289936 IP 192.168.0.99.1463 > 202.102.134.68.53: 45670+ A? (32)
15:05:46.289961 IP 192.168.0.99.1463 > 202.102.134.68.53: 45670+ A? (32)
15:05:46.324662 IP 192.168.0.99.1461 > 202.102.134.68.53: 38246+ A? toolbarqueries.google.com. (43)
15:05:46.324715 IP 192.168.0.99.1461 > 202.102.134.68.53: 38246+ A? toolbarqueries.google.com. (43)
15:05:50.174067 IP 192.168.0.99.1465 > 202.102.134.68.53: 6759+ A? (33)
15:05:50.174102 IP 192.168.0.99.1465 > 202.102.134.68.53: 6759+ A? (33)
15:05:51.264862 IP 192.168.0.99.1467 > 202.102.134.68.53: 58727+ A? news.sina.com.cn. (34)
15:05:51.264878 IP 192.168.0.99.1467 > 202.102.134.68.53: 58727+ A? news.sina.com.cn. (34)
15:05:51.422641 IP 192.168.0.99.1469 > 202.102.134.68.53: 23401+ A? d1.sina.com.cn. (32)
15:05:51.422658 IP 192.168.0.99.1469 > 202.102.134.68.53: 23401+ A? d1.sina.com.cn. (32)
15:05:51.813160 IP 192.168.0.99.1472 > 202.102.134.68.53: 26730+ A? 44.adsina.allyes.com. (3
15:05:51.813188 IP 192.168.0.99.1472 > 202.102.134.68.53: 26730+ A? 44.adsina.allyes.com. (3
15:05:51.833101 IP 192.168.0.99.1474 > 202.102.134.68.53: 34923+ A? ad4.sina.com.cn. (33)
15:05:51.833119 IP 192.168.0.99.1474 > 202.102.134.68.53: 34923+ A? ad4.sina.com.cn. (33)
15:05:53.449275 IP 192.168.0.99.1478 > 202.102.134.68.53: 21613+ A? sinatest2.allyes.com. (3
15:05:53.449292 IP 192.168.0.99.1478 > 202.102.134.68.53: 21613+ A? sinatest2.allyes.com. (3
15:05:54.209914 IP 192.168.0.99.1482 > 202.102.134.68.53: 17262+ A? pfp.sina.com.cn. (33)
15:05:54.209952 IP 192.168.0.99.1482 > 202.102.134.68.53: 17262+ A? pfp.sina.com.cn. (33)
15:05:54.350628 IP 192.168.0.99.1484 > 202.102.134.68.53: 56431+ A? beacon.sina.com.cn. (36)
15:05:54.350649 IP 192.168.0.99.1484 > 202.102.134.68.53: 56431+ A? beacon.sina.com.cn. (36)
15:05:54.902134 IP 192.168.0.99.1491 > 202.102.134.68.53: 44433+ A? pfpip.sina.com. (32)
15:05:54.902149 IP 192.168.0.99.1491 > 202.102.134.68.53: 44433+ A? pfpip.sina.com. (32)
15:05:57.634251 IP 192.168.0.99.1500 > 202.102.134.68.53: 47250+ A? i2.sinaimg.cn. (31)
15:05:57.634295 IP 192.168.0.99.1500 > 202.102.134.68.53: 47250+ A? i2.sinaimg.cn. (31)
15:05:57.700646 IP 192.168.0.99.1502 > 202.102.134.68.53: 1172+ A? i0.sinaimg.cn. (31)
15:05:57.700661 IP 192.168.0.99.1502 > 202.102.134.68.53: 1172+ A? i0.sinaimg.cn. (31)
15:05:57.710324 IP 192.168.0.99.1505 > 202.102.134.68.53: 21397+ A? i1.sinaimg.cn. (31)
15:05:57.710350 IP 192.168.0.99.1505 > 202.102.134.68.53: 21397+ A? i1.sinaimg.cn. (31)
15:06:00.087748 IP 192.168.0.99.1508 > 202.102.134.68.53: 34198+ A? 549.adsina.allyes.com. (39)
15:06:00.087777 IP 192.168.0.99.1508 > 202.102.134.68.53: 34198+ A? 549.adsina.allyes.com. (39)输入文字