tcpdump
tcpdump功能说明：倾倒网络传输数据。
语 法：tcpdump [-adeflnNOpqStvx][-c<数据包数目>][-dd][-ddd][-F<表达文件>][-i<网络界面>][-r<数据包文件>][-s<数据包大小>][-tt][-T<数据包类型>][-vv][-w<数据包文件>][输出数据栏位]
补充说明：执行tcpdump指令可列出经过指定网络界面的数据包文件头，在Linux操作系统中，你必须是系统管理员。
参 数：
-a 尝试将网络和广播地址转换成名称。
-c<数据包数目> 收到指定的数据包数目后，就停止进行倾倒操作。
-d 把编译过的数据包编码转换成可阅读的格式，并倾倒到标准输出。
-dd 把编译过的数据包编码转换成C语言的格式，并倾倒到标准输出。
-ddd 把编译过的数据包编码转换成十进制数字的格式，并倾倒到标准输出。
-e 在每列倾倒资料上显示连接层级的文件头。
-f 用数字显示网际网络地址。
-F<表达文件> 指定内含表达方式的文件。
-i<网络界面> 使用指定的网络截面送出数据包。
-l 使用标准输出列的缓冲区。
-n 不把主机的网络地址转换成名字。
-N 不列出域名。
-O 不将数据包编码最佳化。
-p 不让网络界面进入混杂模式。
-q 快速输出，仅列出少数的传输协议信息。
-r<数据包文件> 从指定的文件读取数据包数据。
-s<数据包大小> 设置每个数据包的大小。
-S 用绝对而非相对数值列出TCP关联数。
-t 在每列倾倒资料上不显示时间戳记。
-tt 在每列倾倒资料上显示未经格式化的时间戳记。
-T<数据包类型> 强制将表达方式所指定的数据包转译成设置的数据包类型。
-v 详细显示指令执行过程。
-vv 更详细显示指令执行过程。
-x 用十六进制字码列出数据包资料。
-w<数据包文件> 把数据包数据写入指定的文件。
tcpdump
tcpdump [options] [expression]
System administration command. Dump headers and packets of network traffic that match expression. The command continues to capture packets until it receives a SIGTERM or SIGINT signal (usually generated by typing the interrupt character control-C). When finished, it will generate a report on traffic captured, received, or dropped by the kernel.
Expressions
Create matching expressions using the following primitives followed by an ID or name.
A qualifier indicating whether to match source or destination information. Accepted values are src, dst, src or dst, and src and dst. When not specified, the expression will match either source or destination traffic.
A qualifier restricting matches to a particular kind of packet. Accepted values are: ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, tcp, and udp. If not specified, the match defaults to any appropriate protocol matching type.
A qualifier indicating what kind of thing the ID or name references, such as a part of a hostname (host), IP address (net) or port (port). When not specified, the match defaults to host.
Options
Print packets in ASCII text.
Exit after receiving n packets.
When saving to a file, do not write files larger than n million bytes. Open a new file with the same basename appended by a number. Start with the number 1.
Compile and dump the packet-matching code for the given expression, then exit. Use the second form to dump it as a C programming fragment. Use the third form to dump the code in decimal.
Print a list of the available interfaces, then exit.
Print the link-level header on each line.
Read expression from the specified file.
Listen on the specified interface. If not specified, tcpdump will listen on the lowest-numbered interface available, other than the loopback interface. Use any to listen to all available interfaces.
Line buffer standard out.
Print the data link types for an interface, then exit.
Print IP addresses instead of converting them to hostnames. Use the second form to leave protocols and port numbers in numeric form, as well.
Print hostnames instead of fully qualified domain names.
Abbreviate output, printing less protocol information.
Read packets from the specified file. (You can create such a file with the -w option.)
Read n bytes of data from each packet. (The default is 68.)
Print absolute TCP sequence numbers.
Read n bytes of data from each packet. (The default is 68.)
Change display of timestamp. Use the first form to omit the timestamp from each line. Use the second form to print an unformatted timestamp. Use the third form to print the time in seconds between the current and the previous dump line. The final form prints the date before the timestamp on each dump line.
Print undecoded NFS handles.
Increase the verbosity of the printout. Each additional v increases the detail of the information printed.
Write the raw packet information to file without parsing or printing it. Specify - to write to standard output.
Print packets in hex. Use the second form to print the packet's link level header in hex as well.
Print packets in hex and ASCII text. Use the second form to print the packet's link level header in hex and ASCII as well.
Drop root privileges and change to the specified user. Use the primary group of the specified user.
Examples
Place full packets into a file named tcpdump.cap for later analysis:
tcpdump -v -w tcpdump.cap -xX -s 0
Read all packet headers received on the eth0 interface, except for arp and SSH packets:
tcpdump -i eth0 not arp and not port ssh