Super easy to use packet capturing tool tcpdump

tcpdump Simple use

tcpdump What is it? ？
tcpdump yes Linux In the character interface of packet capture analysis software

How do you use it? ？
Installation is required first

yum install tcpdump -y

Let's first see what parameters it has , These parameters are usually used for filtering

1、option Optional parameters
2、proto Class filter ： Filter by protocol
3、direction Class filter ： Filter according to the data flow direction
4、type Class filter ： These words need to be followed by parameters

Analysis of packet structure captured

22:29:32.698761 IP 192.168.2.143.53629 > localhost.localdomain.ssh: Flags [P.], seq 37:73, ack 292188, win 4106, length 36

First column ： Time ( Hours, minutes, seconds, milliseconds ),22:29:32.698761
Second column ： Network protocol ,IP
The third column ： The address of the sender , among 192.168.2.143 yes ip, and 53629 It's the port number
The fourth column ： arrow >, Indicates the flow of data
The fifth column ： Address of the receiving party ,localhost.localdomain.ssh
The sixth column ： The colon
The seventh column ： Packet content , Include Flags identifier ,seq Number ,ack Number ,win window , Data length length, among [P.] Express PUSH Sign bit is 1

Easy to use

Grab ens33 Data packets of
tcpdump -i ens33

Show more details
tcpdump -i ens33 -vv

Show mac Address
tcpdump -i ens33 -e

According to the source mac Address to grab packets
tcpdump -i ens33 ether src 00:0c:29:ae:fd:42

According to the source ip Grab the bag
Two virtual machines are needed , virtual machine A Go to ping, virtual machine B Go and grab the bag
virtual machine A Of ip by 192.168.2.170, virtual machine B Of ip by 192.168.2.127

virtual machine A： ping 192.168.2.127

virtual machine B： tcpdump -i ens33 icmp and src 192.168.2.170

Store the data in a file and read

#  Store the packet capturing data in the file 
tcpdump -i ens33 -w test.pcap icmp and src 192.168.2.170

#  View file type 
[[email protected] ~]# file test.pcap 
test.pcap: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 262144)

#  Read the file 
tcpdump -r test.pcap