tshark简单应用指令

#tshark -i 1 -w /usr/tmp/icmp.cap -f"icmp" -b duration:3

测试每三秒捕获icmp网络包

#tshark -i 1 -w /usr/tmp/icmp.cap -f"icmp&&dst 10.166.253.92" -b duration:10

过滤icmp且ip是10.166.253.92

#ps -ef|grep tshark|grep -w 10.166.253.92|awk '{printf $2}'

管道输出上面指令的具体进程ID

#kill -9 `ps -ef|grep tshark|grep -w 10.166.253.92|awk '{printf $2}'`

直接中断该进程

#ps -ef|grep tshark|grep -w 'tshark -i 1 -w /usr/tmp/error.cap -f"icmp&&dst 10.166.253.90" -b duration:30'|awk '{printf $2}'

更精确的查找，直接查找刚才运行指令对应的pid