Linux Tcpdump 使用举例 ---持续更新
作者:互联网
举例:
保存到文件
tcpdump -w xxx.cap(默认抓取eth0的包)
抓eth1的包
tcpdump -i eth1 -w /tmp/xxx.cap
抓到完成的数据包(默认只抓前68字节)
tcpdump -s 0 -w /tmp/xxx.cap
抓192.168.1.123的包
tcpdump -i eth 1 host 192.168.1.123 -w /tmp/xxx.cap
抓取80端口的包
tcpdump -i eth1 port 80 -w /tmp/xxx.cap
抓取范围内的端口
tcpdump -i eth1 portrange 80-82 -w /tmp/xxx.cap
抓192.168.1.123 的 icmp的包
tcpdump -i eth1 host 192.168.1.123 and icmp -w /tmp/xxx.cap
抓192.168.1.123的80端口和22端口之外的其他端口的包
tcpdump -i eth1 host 192.168.1.123 and ! port 80 and ! port 22 -w /tmp/xxx.cap
抓vlan 1的包
tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap
抓pppoe的密码
tcpdump -i eth1 pppoes -w /tmp/xxx.cap
已100m大小分割保存文件,超过100m另开一个文件
tcpdump -i eth1 -C 100m -w /tmp/xxx.cap
抓1000个包后退出
tcpdump -i eth1 -c 1000 -w /tmp/xxx.cap
转自:https://www.cnblogs.com/langdashu/p/5611122.html
标签:tmp,xxx,Tcpdump,cap,192.168,---,Linux,tcpdump,eth1 来源: https://www.cnblogs.com/javalinux/p/15687298.html