Packet capture tcpdump under Linux

When the company connected the socket under Linux, it was found that errors were always reported in the interface, so I studied the packet capture under Linux

tcpdump host #IP address#                                              /Get telnet packets received or sent by host 210.27.48.1

Main options of tcpdump parameters

-i: Specify the network card. The default is eth0
-n: Online ip, Instead of hostname
-c: Specify to capture multiple packages and launch them
-A: The contents of the online package in ASCII mode. This option is useful for protocol packages in text format.
-x: In 16 Display the contents of the packet in binary format
-vvv: Display detailed information
-s: Intercept data according to the packet length; the default is 60 bytes; if the packet is larger than 60 bytes, data will be lost in the packet capture; So we usually set -s 0; this will intercept data according to the size of the packet; what is captured is the complete packet data
-r: Read from the file [corresponds to -w, /usr/sbin/tcpdump - r test.out Read tcpdump -w test.out】
-w: Point to the file everywhere [Be sure to use, -w t.out, and then use -r t.out to see the packet capture information, otherwise it will be readable Very poor】

2. tcpmdump captures the packet and analyzes the specific meaning of the packet

Flags carried by the packet: S: S=SYC: Initiate connection flag P :P=PUSH: Transfer data flag F: F=FIN: Close connection flag ack: Indicates confirmation packet RST=RESET: Abnormally close the connection. Indicates no flag

First line: S: Indicates clinet.hostname The temporary port 50741 initiates a connection to the server.hostname 80 port. The initial packet sequence number of the client is: 562843056; the size of the sliding window (win 14480) is: 14480 [14k] The sliding window is the size of the tcp receiving buffer, used for tcp congestion Control; mss 1460: The maximum packet length that can be received, usually MTU - 40 bytes; IP header and TCP header are each 20 bytes
Second line: S: Indicates SYN status; is server.hostname versus the first line clinet.hostname Response to the request to initiate a connection; at the same time, bring the client's initial packet sequence number 1: ack 562843057, that is, server.hostname will wait to receive the packet with this packet sequence number next time, which is used for the sequence control of the tcp byte stream (?). server.hostname Initial package serial number: 2306923370
Third line: client.hostname Confirm again that the tcp connection has completed the three-way handshake.
The fourth line: P: push data client.hostname sends a data packet to server.hostname through port 50741; the data packet size is 1005byte; the fifth line is that server.hostname responds to this data packet by sending and receiving this data packet. ----> When completed, a server.hostname F packet will appear to close the connection.
Line 6 is not captured here ----> Line 10 is a repetition of lines 1-5; because The machine is that the web service is concurrent.

For more Linux articles, please visit the Linux Tutorial column to learn!

The above is the detailed content of Packet capture tcpdump under Linux. For more information, please follow other related articles on the PHP Chinese website!