tcpdump 抓包工具练习题
实用 tcpdump 命令
同理,也可以使用上面的命令,查看kafka,etcd,redis,mc等的命令情况,只要是明文协议都可以
tcpdump命令格式
option 举例 -n, -i any 等
filter 是过滤包的条件,举例: tcp, portrange 1-1000, src port 58895, host www.itshouce.com.cn,
filter可以进行组合 比如:
dst port 3306 and src port 58895
portrange 1-1000 or src port 58895
not dst port 3306
option filter
举例: tcpdump -i any -n portrange 1-3306 or portrange 10000-58895
tcpdump option
-n 不要把ip转换为机器名字
-rw-r--r-- 1 root wheel 1000092 Apr 21 21:05 a.cap
-rw-r--r-- 1 root wheel 849388 Apr 21 21:05 a.cap1
#tcpdump -A host www.itshouce.com.cn
...
3 packets captured
65 packets received by filter
0 packets dropped by kernel
1.en0
2.awdl0
3.bridge0
4.utun0
5.en1
6.en2
7.p2p0
8.lo0
21:15:27.665159 *:*:60:dc:d0:d9 (oui Unknown) > *:*:07:10:81:36 (oui Unknown), ethertype IPv4 (0x0800), length 79: zj-db0355dembp.lan.51318 > hiwifi.lan.domain: 20430+ A? www.itshouce.com.cn. (37)
21:33:06.569478 IP *dembp.lan.54864 > ***: Flags [P.], seq 3980049501:3980049596, ack 3916671858, win 4091, options [nop,nop,TS val 1201572125 ecr 1490447193], length 95
listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
listening on pktap, link-type PKTAP (Packet Tap), capture size 256 bytes
tcpdump过滤项
下面所有测试中都有 -i any的选项,表示抓取所有网络接口上的包,只是为了让测试方便
22:39:58.991043 ARP, Request who-has 192.168.199.125 tell 192.168.199.1, length 28
22:39:58.991059 ARP, Reply 192.168.199.125 is-at a4:5e:60:dc:d0:d9, length 28
22:53:06.041382 IP 192.168.199.125.63161 > 119.75.219.45.80: Flags [F.], seq 0, ack 1, win 65535, length 0
22:57:48.343422 IP 112.80.248.73.80 > 192.168.199.125.63275: Flags [.], seq 38478:39918, ack 78, win 193, length 1440
22:58:51.165333 IP 112.80.248.74.80 > 192.168.199.125.63298: Flags [F.], seq 100439, ack 79, win 193, length 0
22:58:51.165349 IP 192.168.199.125.63298 > 112.80.248.74.80: Flags [R], seq 703147494, win 0, length 0
23:00:13.550006 IP 192.168.199.125.63310 > *.*.248.73.80: Flags [.], ack 71649, win 8012, length 0
23:01:27.363723 IP 192.168.199.125.63327 > 192.168.21.1.23: Flags [S], seq 621213649, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 1240986522 ecr 0,sackOK,eol], length 0
22:22:17.445872 IP *0355dembp.lan > 112.80.248.73: ICMP echo request, id 26478, seq 0, length 64
2:22:50.108236 IP *0355dembp.lan.62371 > 112.80.248.74.https: Flags [S], seq 2884215363, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 1238683151 ecr 0,sackOK,eol], length 0
22:26:46.808706 IP zj-db0355dembp.lan > 192.168.1.2: ICMP echo request, id 31854, seq 0, length 64
22:30:50.490355 IP 192.168.199.125.61086 > *.*.*.*.341: Flags [.], ack 56, win 8185, options [nop,nop,TS val 1239157627 ecr 1580310986], length 0
22:38:07.580567 IP *.*.*.*.34186 > 192.168.199.125.61086: Flags [P.], seq 787907565:787907668, ack 871423065, win 126, options [nop,nop,TS val 1580748123 ecr 1239593243], length 103
22:38:08.453788 IP 192.168.199.125.61086 > *.*.*.*.34186: Flags [P.], seq 9481:10147, ack 5769, win 8179, options [nop,nop,TS val 1239594178 ecr 1580748994], length 666
21:09:17.687673 IP 192.168.199.1.50150 > *.*.*.*.1900: UDP, length 385
21:13:21.801351 IP 192.168.199.125.64826 > *.*.*.*.80: Flags [P.], seq 2155:3267, ack 44930, win 8192, length 1112
1:21:18.777815 IP 192.168.199.125.50249 > *.*.*.*.443: Flags [.], ack 75, win 4093, options [nop,nop,TS val 1269008649 ecr 44997038], length 0
21:22:48.434449 IP 192.168.199.1.50150 > *.*.*.*.1900: UDP, length 385
21:25:42.550374 IP 192.168.199.1 > 192.168.199.125: ICMP *.*.*.* unreachable - need to frag (mtu 1480), length 556