Common methods of grabbing packets in unix

1.HP-UX

Use the nettl and netfmt commands together

a. Edit filtering Profil

Filter out the network information you are interested in

The configuration file format is as follows:

Filter.conf:

Filter ip_saddr 192.6.2.1

Filter ip_daddr 192.6.2.1

Filter udp_sport 2049

Filter udp_dport 2049

Filter tcp_sport 23

Filter tcp_dport 23 / * TCP port 23 = telent

b. Start the packet capture service

Nettl-start

c. Start grabbing the bag

Nettl-tn 0x30800000-e ns_ls_ip-size 1024-tracemax 99999-f / tmp/raw0

d. Stop grabbing bags

Nettl-tf-e all

e. Stop the bag grabbing service

Nettl-stop

f. Check the contents of the grab package.

Netfmt-N-n-l-c / tmp/filter.conf-f / tmp/raw0.TRC000

2.Solaris

Use the snoop command that comes with the system

Snoop-d bge0 host 192.168.1.1 port 1521

3.Linux

Use the tcpdump that comes with the system

Tcpdump-I eth0 dst port 1521

4. AIX

A. Iptrace is used with the ipreport command

If iptrace is started on the command line instead of SRC, it must be stopped with kill-15, otherwise some kernel resources will not be released.

Iptrace generates trace files; ipreport outputs trace file contents

b. Use the tcpdump that comes with the system