The tcpdump command can list the headers of data packets passing through the specified network interface, and can completely remove the "headers" of data packets transmitted on the network. Capture it and provide analysis. It supports filtering for network layer, protocol, host, network or port, and provides logical statements such as and, or, not to help you extract useful information.
Because it requires setting the network interface to promiscuous mode, ordinary users cannot execute it normally, but users with root permissions can execute it directly to obtain information on the network
Other packet capture tools
wireshark has both graphical and command line versions, which can analyze the packets captured by tcpdump , its main function is to analyze data packets.
ngrep will directly display the captured packet data in text form, which is suitable for [capture] analysis of packet data containing text (such as HTTP, MySQL )
-a Convert network address and broadcast address into name
-A Print out all groups in ASCII format and Minimize the header of the link layer
-b Select protocols on the data link layer, including ip/arp/rarp/ipx are all in this layer
-c Specifies the number of times to receive data packets, that is, exit tcpdump after receiving the specified number of data packets
-d Will match the code of the information packet in a human-readable format Assembly format output
-dd Output the code of the matching information packet in the format of c language program segment
-ddd Output the code of the matching information packet in decimal form
-D Print all network interfaces that can be monitored in the system
-e Print the header information of the data link layer on the output line
-f Prints the external Internet address in numerical form, that is, does not display the host name
-F From the specified file Read the expression and ignore other expressions
-i Specify the listening network interface
-l Make the standard output a buffered form, Can export data to a file
-L Lists the known data links of the network interface
-n Does not convert network addresses to names
-N does not output the domain name part of the host name, for example www.baidu.com only outputs www
-nn does not output the port name Conversion
-P Do not set the network interface to promiscuous mode
-q Fast output, that is, only output less protocol information
-r Read data from the specified file, usually -w saved file
-w Save the captured information to file, and does not parse and print to the screen
-s read snaplen bytes from each group at the beginning instead of the default 68 bytes
-S Output the tcp sequence number as an absolute value instead of a relative value
-T Directly parse the monitored packets into the specified type of message, common types include rpc (remote procedure call) and snmp (simple network management protocol)
-t Do not print a timestamp in each line of output
-tt Output unformatted timestamp in each line
-ttt Output the time difference between this line and the previous one
-tttt Output the timestamp in the default format of data processing in each line
##-u Output the undecoded NFS handle
-v outputs slightly more detailed information, for example, the ip package can include ttl and service type information
-vv Output the trusted message information
3. tcpdump expression
Keywords about data type
Includes host, port, net:
host 192.168.100.1 represents a host, net 192.168.100.0 represents a network segment, port 80 indicates the port number is 80, if there is no Specify the data type, then the default is host
牛逼啊！接私活必备的 N 个开源项目！赶快收藏
Copy after login
Keywords for data transmission direction
Includes src, dst, dst or src, dst and src, these keywords specify Indicates the direction of transmission, for example, src 192.168.100.1 indicates that the source address of the data packet is 192.168.100.1. dst net 192.168.100.0 indicates that the destination network address is 192.168.100.0. The default is to monitor the src and dst of the host to the host, that is, the default is to monitor all data of the local machine and the target host. Protocol Keywords
Tcpdump parses message information without wireshark details , so the data can be captured and output through Tcpdump, and then parsed through wireshark. The output file format is .pcap or other
Read through wireshark on the virtual machine
Use ip.addr == [ip address number] OK Filter out irrelevant IP
Graphic reading
##Open directly with wireshark to view
Summary
tcpdump and wireshark are similar in terms of packet capture functions. The command line options of the two are also the same, but tcpdump has the ability to analyze packets. Not very good. At the same time, many Linux systems currently have the tcpdump tool installed built-in, so we can use tcpdump to capture the data packets and store them in our customized files (.pcap), and then extract the files and use wireshark to analyze and troubleshoot.
#
The above is the detailed content of Linux network packet capture analysis tool. For more information, please follow other related articles on the PHP Chinese website!
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
