tcpdump?
A command line tool for analyzing network packets.
How to get packets?
Using -i
option, tcpdump -i <device-name>
, you would get the packet through NIC(network interface card) named .
How to get <device-name>
?
using ip link
could get some, e.g.
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 08:01:37:d1:9c:bd brd ff:ff:ff:ff:ff:ff
$ tcpdump -i eth0
Now I know how to get all packets through certain NIC, but I want to analysis specify connections, how can I get it?
Expression.
What Expression?
tcpdump expression.
What is tcpdump expression?
A set of combinable rules, for example src 10.0.0.10
means only the packets from 10.0.0.10
would show.Here is a list(incomplete) of tcpdump expression, the #
leading comments:
host 10.0.0.10 # from or to 10.0.0.10
port 23 # contains port 23
dst 10.0.0.10 # as src, but for destination
# Protocols
arp # only ARP
icmp
tcp
udp
fddi
ether
# Protocol logic is simple, is not, for all
You say they are combinable, how they combined?
Good question, they can be combined with or
, and
or with leading !
(not); or
is or
, not and
, for example, src 10.0.0.10 or src 10.0.0.11
is for packets from 10.0.0.10
or 10.0.0.11
, obviously.
I found packets not showing all informations I want, what could I do?
Simple, tcpdump has -v
for verbose output, -vv
for more verbose, -vvv
for even more verbose. -vvvv
for… no, I’m kidding.
Ha, that’s funny, and the timestamp is not readable for me, how to make it more friendly?
Use -t
, and not kidding, use -ttttt
for maximally timestamp, and you have -kt, k <- 1..=5
for different level output.
I found the IP be replaced by host name but I don’t want it, how to remove it?
-n
would tell tcpdump
stop convert address.
What if I want to save my hard working result?
-w <filename>
is what you’re looking for, it would write the raw packets to file named <filename>
rather than parsing & printing. And remember you can record packets into a file, and use Wireshark to analysis it! For complex flow analyzing, I would do that. Now, the most important path already covered, you can always get more & fresher information about it from manpage
of tcpdump
, good lucks.
Top comments (0)