tcpdump抓包

它支持针对网络层、协议、主机、网络或端口的过滤，并提供and、or、not等逻辑语句来帮助你去掉无用的信息。

tcpdump -n -i bond0 -s 0 host 192.168.1.101 -w /opt/tcpdump.txt

过滤与192.168.1.101所有通信并保存在/opt/tcpdump.txt，分析则建议使用第三方
工具。

常用参数

-i 指定tcpdump监听的网络接口   eth0  bond0等等
-s 指定要监听数据包的长度
-c指定要监听的数据包数量，达到指定数量后自动停止抓包
-w 指定将监听到的数据包写入文件中保存
-A 指定将每个监听到的数据包以ACSII可见字符打印
-n 指定将每个监听到数据包中的域名转换成IP地址后显示
-nn 指定将每个监听到的数据包中的域名转换成IP、端口从应用名称转换成端口号后显示
-e 指定将监听到的数据包链路层的信息打印出来，包括源mac和目的mac，以及网络层的协议
-p 将网卡设置为非混杂模式，不能与host或broadcast一起使用
-r 指定从某个文件中读取数据包
-S 指定打印每个监听到的数据包的TCP绝对序列号而非相对序列号
-c 抓的包个数  数字
-T 强制tcpdump按type指定的协议所描述的包结构来分析收到的数据包.  目前已知的type 可取的协议为:cnfp，tftp,rtcp等



host  指定主机
src host hostname 抓从hostname发出的包
dst host hostname 抓发送到hostname的包

例子：
查看保存文件中的信息

[root@localhost ~]# tcpdump -r /opt/tcpdump.txt

reading from file /root/tcpdump.txt, link-type EN10MB (Ethernet)
05:23:14.619795 ARP, Request who-has 192.168.1.101 tell 192.168.1.189, length 46
05:23:14.620419 ARP, Reply 192.168.1.101 is-at 00:0c:29:c8:4d:d7 (oui Unknown), length 46
05:23:14.620421 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [P.], seq 1999336158:1999336206, ack 2066103778, win 4102, length 48
05:23:14.621003 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 1:49, ack 48, win 343, length 48
05:23:14.621601 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 49:129, ack 48, win 343, length 80
05:23:14.621602 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [.], ack 129, win 4102, length 0
05:23:14.621705 IP 192.168.1.101 > localhost.localdomain: ICMP echo request, id 2226, seq 1, length 64
05:23:14.621744 IP localhost.localdomain > 192.168.1.101: ICMP echo reply, id 2226, seq 1, length 64
05:23:14.622178 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 129:225, ack 48, win 343, length 96
05:23:14.661730 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [.], ack 225, win 4101, length 0
05:23:15.623242 IP 192.168.1.101 > localhost.localdomain: ICMP echo request, id 2226, seq 2, length 64
05:23:15.623328 IP localhost.localdomain > 192.168.1.101: ICMP echo reply, id 2226, seq 2, length 64
05:23:15.624356 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 225:289, ack 48, win 343, length 64
05:23:15.666697 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [.], ack 289, win 4101, length 0
05:23:16.625243 IP 192.168.1.101 > localhost.localdomain: ICMP echo request, id 2226, seq 3, length 64
05:23:16.625330 IP localhost.localdomain > 192.168.1.101: ICMP echo reply, id 2226, seq 3, length 64
05:23:16.626290 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 289:353, ack 48, win 343, length 64
05:23:16.678962 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [.], ack 353, win 4101, length 0
05:23:17.626748 IP 192.168.1.101 > localhost.localdomain: ICMP echo request, id 2226, seq 4, length 64
05:23:17.626836 IP localhost.localdomain > 192.168.1.101: ICMP echo reply, id 2226, seq 4, length 64
05:23:17.628329 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 353:417, ack 48, win 343, length 64
05:23:17.671273 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [.], ack 417, win 4101, length 0
05:23:18.628098 IP 192.168.1.101 > localhost.localdomain: ICMP echo request, id 2226, seq 5, length 64
05:23:18.628294 IP localhost.localdomain > 192.168.1.101: ICMP echo reply, id 2226, seq 5, length 64
05:23:18.629769 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 417:481, ack 48, win 343, length 64
05:23:18.670439 IP 192.168.1.189.63059 > 192.168.1.101.ssh: Flags [.], ack 481, win 4100, length 0
05:23:19.630090 IP 192.168.1.101 > localhost.localdomain: ICMP echo request, id 2226, seq 6, length 64
05:23:19.630179 IP localhost.localdomain > 192.168.1.101: ICMP echo reply, id 2226, seq 6, length 64
05:23:19.631200 IP 192.168.1.101.ssh > 192.168.1.189.63059: Flags [P.], seq 481:545, ack 48, win 343, length 64
05:23:19.634857 ARP, Request who-has 192.168.1.101 tell localhost.localdomain, length 28

如果想要获取主机210.27.48.1除了和主机210.27.48.2之外所有主机通信的ip包，使用命令：

tcpdump ip host 210.27.48.1 and ! 210.27.48.2

如果想要获取主机210.27.48.1接收或发出的telnet包，使用如下命令

tcpdump tcp port 23 and host 210.27.48.1

对本机的udp 123 端口进行监视 123 为ntp的服务端口

tcpdump udp port 123 

wireshark windows的抓包工具，可以用tcpdump抓包，然后再wireshark里分析。

参考：
https://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html