Shulou(Shulou.com)06/02 Report--

Today, I will talk to you about how to analyze the Linux tcpdump command to grab the package and save the pcap file wireshark. Many people may not know much about it. In order to make you understand better, the editor has summarized the following contents for you. I hope you can get something according to this article.

The command parameter for saving tcpdump's grab package to file is-w xxx.cap.

Grab eth2's bag.

Tcpdump-I eth2-w / tmp/xxx.cap

Grab the bag of 192.168.1.123

Tcpdump-I eth2 host 192.168.1.123-w / tmp/xxx.cap

Grab the packet of port 80 of 192.168.1.123

Tcpdump-I eth2 host 192.168.1.123 and port 80-w / tmp/xxx.cap

Grab the icmp bag of 192.168.1.123

Tcpdump-I eth2 host 192.168.1.123 and icmp-w / tmp/xxx.cap

Grab the packets of port 80 of 192.168.1.123 and ports other than 110 and 25

Tcpdump-I eth2 host 192.168.1.123 and! Port 80 and! Port 25 and! Port 110w / tmp/xxx.cap

Grab vlan 1's bag

Tcpdump-I eth2 port 80 and vlan 1-w / tmp/xxx.cap

The password to catch pppoe.

Tcpdump-I eth2 pppoes-w / tmp/xxx.cap

Save the file with a size of 100m, and open another file over 100m-C 100m

Grab 10000 packages and quit-c 10000

The packet is captured at the backend, and the exit of the console will not affect:

Nohup tcpdump-I eth2 port 110w / tmp/xxx.cap &

The captured files can be opened directly with ethereal or wireshark.

After reading the above, do you have any further understanding of how to analyze the Linux tcpdump command to grab the package and save the pcap file wireshark? If you want to know more knowledge or related content, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.