linux命令——tcpdump 抓包及文件分割

首先，tcpdump的命令详情

 tcpdump --help
tcpdump version 4.9.2
libpcap version 1.5.3
OpenSSL 1.0.2k-fips  26 Jan 2017
Usage: tcpdump [-aAbdDefhHIJKlLnNOpqStuUvxX#] [ -B size ] [ -c count ]
                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                [ -i interface ] [ -j tstamptype ] [ -M secret ] [ --number ]
                [ -Q|-P in|out|inout ]
                [ -r file ] [ -s snaplen ] [ --time-stamp-precision precision ]
                [ --immediate-mode ] [ -T type ] [ --version ] [ -V file ]
                [ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]

1、抓包命令

tcpdump -i eth0 -w file001.cap

2、文件分割

当抓的包太大，导致Wireshark不能完全打开，所以将文件分割。如下：

tcpdump -r file001.cap -C 100M -w newfile001.cap

每个文件最大100M

待续……