Preface
In our previous article, we have seen 20 Netstat Commands to monitor or mange Linux network. This is our another ongoing series of packet sniffer tool called tcpdump. Here, we are going to show you how to install tcpdump and then we discuss and cover some useful commands with their practical examples.
tcpdump is a most powerful and widely used command-line packets sniffer or package analyzer tool which is used to capture or filter TCP/IP packets that received or transferred over a network on a specific interface. It is available under most of the Linux/Unix based operating systems. tcpdump also gives us a option to save captured packets in a file for future analysis. It saves the file in a pcap format, that can be viewed by tcpdump command or a open source GUI based tool called Wireshark (Network Protocol Analyzier) that reads tcpdump pcap format files.
How to Install tcpdump in Linux
Many of Linux distributions already shipped with tcpdump tool, if in case you don’t have it on systems, you can install it using following Yum command.
Once tcpdump tool is installed on systems, you can continue to browse following commands with their examples.
tcpdump 的運算式(expression) 介紹:
tcpdump 利用運算式作為過濾 packet 的條件，如果一個 packet 滿足表達式的條件，則這個 packet 將會被捕獲。如果沒有給出任何條件，則網路上所有的資訊包將會被截獲。
在運算式中一般如下幾種類型的關鍵字，一種是關於類型的關鍵字，主要包括 host，net，port, 例如 host 210.27.48.2，指明 210.27.48.2是一台主機，net 202.0.0.0 指明 202.0.0.0 是一個網路位址，port 23 指明埠號是23。如果沒有指定類型，缺省的類型是 host.
第二種是確定傳輸方向的關鍵字，主要包括 src , dst ,dst or src, dst and src, 這些關鍵字指明了傳輸的方向。舉例說明，src 210.27.48.2 ,指明 ip 包中源地址是 210.27.48.2 , dst net202.0.0.0 指明目的網路位址是 202.0.0.0 。如果沒有指明方向關鍵字，則缺省是 src or dst 關鍵字。
第三種是協議的關鍵字，主要包括 fddi,ip ,arp ,rarp ,tcp ,udp 等類型。Fddi指明是在FDDI(分散式光纖資料介面網路)上的特定的網路協定，實際上它是 "ether" 的別名，fddi 和 ether 具有類似的源位址和目的地址，所以可以將 fddi 協議包當作 ether 的包進行處理和分析。其他的幾個關鍵字就是指明了監聽的包的協定內容。如果沒有指定任何協議，則 tcpdump 將會監聽所有協定的資訊包。
除了這三種類型的關鍵字之外，其他重要的關鍵字如下：gateway, broadcast,less ,greater, 還有三種邏輯運算，取非運算是 'not ', '!', 與運算是 'and' , '&&'; 或運算 是'or' , '||'. 這些關鍵字可以組合起來構成強大的組合條件來滿足人們的需要. 下面舉幾個例子來說明:
截獲所有210.27.48.1 的主機收到的和發出的所有的資料包
截獲主機 210.27.48.1 和主機 210.27.48.2 或 210.27.48.3 的通信
獲取主機 210.27.48.1 除了和主機 210.27.48.2 之外所有主機通信的 ip 包
獲取主機 210.27.48.1 接收或發出的 telnet packet
Usage Example
Capture Packets from Specific Interface
The command screen will scroll up until you interrupt and when we execute tcpdump command it will captures from all the interfaces, however with -i switch only capture from desire interface.
Capture Only N Number of Packets
When you run tcpdump command it will capture all the packets for specified interface, until you Hit cancel button. But using -c option, you can capture specified number of packets. The below example will only capture 5 packets.
Print Captured Packets in ASCII
The below tcpdump command with option -A displays the package in ASCII format. It is a character-encoding scheme format.
Display Available Interfaces
To list number of available interfaces on the system, run the following command with -D option.
Capture and Save Packets in a File
As we said, that tcpdump has a feature to capture and save the file in a .pcap format, to do this just execute command with -w option.
Read Captured Packets File
To read and analyze captured packet 0001.pcap file use the command with -r option, as shown below:
Capture IP address Packets
To capture packets for a specific interface, run the following command with option -n.
Capture only TCP Packets.
To capture packets based on TCP port, run the following command with option tcp.
Capture Packet from Specific Port
Let’s say you want to capture packets for specific port 22, execute the below command by specifying port number 22 as shown below.
Capture Packets from source IP
To capture packets from source IP, say you want to capture packets for 192.168.0.2, use the command as follows.
Capture Packets from destination IP
To capture packets from destination IP, say you want to capture packets for 50.116.66.139, use the command as follows.
This article may help you to explore tcpdump command in depth and also to capture and analysis packets in future. There are number of options available, you can use the options as per your requirement. Please share if you find this article useful through our comment box.
Supplement
* Tsung's Blog - Tcpdump的使用
沒有留言:
張貼留言