tcpdump基本使用和实战分析

1. tcpdump基本命令

  tcpdump -n                    将主机名转换为IP地址
    tcpdump -v                    信息增多
    tcpdump -i lo                 指定网络接口，eth或者lo这类的
    tcpdump -w ./tcpdata.pcap     将信息保存为tcpdata.pcap，支持使用wireshark工具分析
    tcpdump -r ./tcpdata.pcap     从tcpdata.pcap读数据
    tcpdump -s 100                指定抓包大小,缺省抓65535字节的，可以指定100字节，表示过滤掉超过100字节的size
    tcpdump -c 100                抓100个数量包就退出
    tcpdump -XX(xx)                   打印16进制数据
    tcpdump -A                    只打印ASCII码

2. tcpdump过滤

   tcpdump -nvvv -i lo host 127.0.0.1                              查找特定网卡和特定主机的流量
    tcpdump -nvvv -i lo src host 127.0.0.1                          只显示源地址为特定主机的流量
    tcpdump -nvvv -i lo dst host 127.0.0.1                          只显示目标ip的主机流量
    tcpdump -nvvv -i lo port 9877 and port 65522                    只显示端口9877和65522的流量
    tcpdump -nvvv -i lo '(port 9877 or port 22) and host 127.0.0.1' 查找两个特定端口和来自特定主机的数据流
    tcp dump -nvvv -i lo 'port 80 and host 127.0.0.1'
    tcpdump tcp -nvvv -i lo                                         对tcp协议进行抓包,网卡为回环
注意： 如果写成
        tcpdump tcp -nvvv -i lo host 127.0.0.1会报错，因为tcp层检测的是port，所以可以按照如下 tcpdump tcp -nvvv -i lo port 22 或者 tcpdump tcp -nvvv -i lo and host 127.0.0.1

3. 实战

1）客户端代码

代码资源和编译传送:链接: unpv13e在arm上编译
代码路径和运行

root@ubuntu:/opt/socket/unpv13e/intro# ./daytimetcpcli 127.0.0.1
Tue May 31 13:57:16 2022

#include	"unp.h"

int
main(int argc, char **argv)
{
	int					sockfd, n;
	char				recvline[MAXLINE + 1];
	struct sockaddr_in	servaddr;

	if (argc != 2)
		err_quit("usage: a.out <IPaddress>");

	if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
		err_sys("socket error");

	bzero(&servaddr, sizeof(servaddr));
	servaddr.sin_family = AF_INET;
	servaddr.sin_port   = htons(13);	/* daytime server */
	if (inet_pton(AF_INET, argv[1], &servaddr.sin_addr) <= 0)
		err_quit("inet_pton error for %s", argv[1]);

	if (connect(sockfd, (SA *) &servaddr, sizeof(servaddr)) < 0)
		err_sys("connect error");

	while ( (n = read(sockfd, recvline, MAXLINE)) > 0) {
		recvline[n] = 0;	/* null terminate */
		if (fputs(recvline, stdout) == EOF)
			err_sys("fputs error");
	}
	if (n < 0)
		err_sys("read error");

	exit(0);
}

2) 服务端代码

编译后的可执行文件和路径:

root@ubuntu:/opt/socket/unpv13e/intro# pwd
/opt/socket/unpv13e/intro
root@ubuntu:/opt/socket/unpv13e/intro# ./daytimetcpsrv

#include	"unp.h"
#include	<time.h>

int
main(int argc, char **argv)
{
	int					listenfd, connfd;
	struct sockaddr_in	servaddr;
	char				buff[MAXLINE];
	time_t				ticks;

	listenfd = Socket(AF_INET, SOCK_STREAM, 0);

	bzero(&servaddr, sizeof(servaddr));
	servaddr.sin_family      = AF_INET;
	servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
	servaddr.sin_port        = htons(13);	/* daytime server */

	Bind(listenfd, (SA *) &servaddr, sizeof(servaddr));

	Listen(listenfd, LISTENQ);

	for ( ; ; ) {
		connfd = Accept(listenfd, (SA *) NULL, NULL);

        ticks = time(NULL);
        snprintf(buff, sizeof(buff), "%.24s\r\n", ctime(&ticks));
        Write(connfd, buff, strlen(buff));

		Close(connfd);
	}
}

3）抓包和运行

先行运行服务端， 后运行客户端， 在运行客户端前运行tcpdump抓包：

1. 查看Flags，[s]表示主动连接，SYN J， [S.]表示确认 SYN K, ACK J+1，[.]表示ACK K+1
   [P]表示数据推送，[F] -FIN表示主动关闭， [R] -RST，表示重启连接

root@ubuntu:/opt/socket/unpv13e/intro# tcpdump  tcp -nvvv -i lo 'port 13 and host 127.0.0.1' -XX
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
13:51:26.547092 IP (tos 0x0, ttl 64, id 32738, offset 0, flags [DF], proto TCP (6), length 60)
    127.0.0.1.56914 > 127.0.0.1.13: Flags [S], cksum 0xfe30 (incorrect -> 0x8813), seq 2966685731, win 65495, options [mss 65495,sackOK,TS val 1016067079 ecr 0,nop,wscale 7], length 0
	0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
	0x0010:  003c 7fe2 4000 4006 bcd7 7f00 0001 7f00  .<..@.@.........
	0x0020:  0001 de52 000d b0d4 0823 0000 0000 a002  ...R.....#......
	0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 3c8f  ...0..........<.
	0x0040:  f407 0000 0000 0103 0307                 ..........
13:51:26.547181 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    127.0.0.1.13 > 127.0.0.1.56914: Flags [S.], cksum 0xfe30 (incorrect -> 0x0dc8), seq 1034488838, ack 2966685732, win 65483, options [mss 65495,sackOK,TS val 1016067079 ecr 1016067079,nop,wscale 7], length 0
	0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
	0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00  .<..@.@.<.......
	0x0020:  0001 000d de52 3da9 0c06 b0d4 0824 a012  .....R=......$..
	0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 3c8f  ...0..........<.
	0x0040:  f407 3c8f f407 0103 0307                 ..<.......
13:51:26.547195 IP (tos 0x0, ttl 64, id 32739, offset 0, flags [DF], proto TCP (6), length 52)
    127.0.0.1.56914 > 127.0.0.1.13: Flags [.], cksum 0xfe28 (incorrect -> 0x3483), seq 1, ack 1, win 512, options [nop,nop,TS val 1016067080 ecr 1016067079], length 0
	0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
	0x0010:  0034 7fe3 4000 4006 bcde 7f00 0001 7f00  .4..@.@.........
	0x0020:  0001 de52 000d b0d4 0824 3da9 0c07 8010  ...R.....$=.....
	0x0030:  0200 fe28 0000 0101 080a 3c8f f408 3c8f  ...(......<...<.
	0x0040:  f407                                     ..
13:51:26.547398 IP (tos 0x0, ttl 64, id 32815, offset 0, flags [DF], proto TCP (6), length 78)
    127.0.0.1.13 > 127.0.0.1.56914: Flags [P.], cksum 0xfe42 (incorrect -> 0x16bc), seq 1:27, ack 1, win 512, options [nop,nop,TS val 1016067080 ecr 1016067080], length 26
	0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
	0x0010:  004e 802f 4000 4006 bc78 7f00 0001 7f00  .N./@.@..x......
	0x0020:  0001 000d de52 3da9 0c07 b0d4 0824 8018  .....R=......$..
	0x0030:  0200 fe42 0000 0101 080a 3c8f f408 3c8f  ...B......<...<.
	0x0040:  f408 5475 6520 4d61 7920 3331 2031 333a  ..Tue.May.31.13:
	0x0050:  3531 3a32 3620 3230 3232 0d0a            51:26.2022..
13:51:26.549227 IP (tos 0x0, ttl 64, id 32740, offset 0, flags [DF], proto TCP (6), length 52)
    127.0.0.1.56914 > 127.0.0.1.13: Flags [.], cksum 0xfe28 (incorrect -> 0x3466), seq 1, ack 27, win 512, options [nop,nop,TS val 1016067082 ecr 1016067080], length 0
	0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
	0x0010:  0034 7fe4 4000 4006 bcdd 7f00 0001 7f00  .4..@.@.........
	0x0020:  0001 de52 000d b0d4 0824 3da9 0c21 8010  ...R.....$=..!..
	0x0030:  0200 fe28 0000 0101 080a 3c8f f40a 3c8f  ...(......<...<.
	0x0040:  f408                                     ..
13:51:26.550707 IP (tos 0x0, ttl 64, id 32741, offset 0, flags [DF], proto TCP (6), length 52)
    127.0.0.1.56914 > 127.0.0.1.13: Flags [F.], cksum 0xfe28 (incorrect -> 0x3463), seq 1, ack 28, win 512, options [nop,nop,TS val 1016067083 ecr 1016067080], length 0
	0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
	0x0010:  0034 7fe5 4000 4006 bcdc 7f00 0001 7f00  .4..@.@.........
	0x0020:  0001 de52 000d b0d4 0824 3da9 0c22 8011  ...R.....$=.."..
	0x0030:  0200 fe28 0000 0101 080a 3c8f f40b 3c8f  ...(......<...<.
	0x0040:  f408                                     ..

4) 分析

三次握手

连接终止