tcpdump抓tcp头部报文

转载地址：

#defineTH_FIN0x01

#defineTH_SYN0x02

#defineTH_RST0x04

#defineTH_PUSH0x08

#defineTH_ACK0x10

#defineTH_URG0x20

#defineTH_ECE0x40

#defineTH_CWR0x80

 

/* table of valid flag combinations - PUSH, ECE and CWR are always valid */

static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =

{

[TH_SYN]= 1,      //tcp[13]==2

[TH_SYN|TH_URG]= 1,

[TH_SYN|TH_ACK]= 1,  //tcp[13]==18

[TH_RST]= 1,      //tcp[13]==4

[TH_RST|TH_ACK]= 1,

[TH_FIN|TH_ACK]= 1,

[TH_FIN|TH_ACK|TH_URG]= 1,

[TH_ACK]= 1,    //tcp[13]==16

[TH_ACK|TH_URG]= 1,

};

syn或syn+ack tcp[13]&2==2
tcpdump -i eth1 -n 'tcp[13]&==2'