linux:tcpdump
no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
Previous revision | |||
— | linux:tcpdump [2016/05/05 13:07] (current) – external edit 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== tcpdump ====== | ||
+ | Today I check my Gmail, and found a email from Digital Ocean, warned me that the server owned by me was attacking another server. | ||
+ | |||
+ | So I want to find out what the problem is, and the tools I used is | ||
+ | - tcpdump | ||
+ | - netstat | ||
+ | - wireshark | ||
+ | |||
+ | |||
+ | < | ||
+ | tcpdump -i eth0 -vvv -X | ||
+ | tcpdump -i eth0 -vvv -X not host | ||
+ | </ | ||
+ | |||
+ | netstat -anp | ||
+ | | ||
+ | | ||
+ | < | ||
+ | tcpdump tcp -i eth1 -t -s 0 -c 100 and dst port ! 22 and src net 192.168.1.0/ | ||
+ | |||
+ | |||
+ | (1)tcp: ip icmp arp rarp 和 tcp、udp、icmp这些选项等都要放到第一个参数的位置,用来过滤数据报的类型 | ||
+ | (2)-i eth1 : 只抓经过接口eth1的包 | ||
+ | (3)-t : 不显示时间戳 | ||
+ | (4)-s 0 : 抓取数据包时默认抓取长度为68字节。加上-S 0 后可以抓到完整的数据包 | ||
+ | (5)-c 100 : 只抓取100个数据包 | ||
+ | (6)dst port ! 22 : 不抓取目标端口是22的数据包 | ||
+ | (7)src net 192.168.1.0/ | ||
+ | (8)-w ./ | ||
+ | |||
+ | </ |
/var/www/dokuwiki/wiki/data/pages/linux/tcpdump.txt · Last modified: 2016/05/05 13:07 by 127.0.0.1