小蘇的世界

http://www.tcpdump.org/tcpdump_man.html <-- manual page

tcpdump can read all or certain packets going over the ethernet.
tcpdump is often used to save the network traffic in a file.

簡單來說…就是可以將流經網卡的封包抓取下來…存成檔案加以分析就對了~

絕大部分的Unix-Like System 都有這個指令可以使用
算是很常使用到的基本指令之一…底下會稍微介紹這指令的用法…
如果沒有這指令可以用的話…可以自行安裝…包括libpcap,tcpdump等相關套件

 tcpdump [ -adeflnNOpqRStuvxX ] [ -c count ]
                [ -C file_size ] [ -F file ]
                [ -i interface ] [ -m module ] [ -r file ]
                [ -s snaplen ] [ -T type ] [ -w file ]
                [ -E algo:secret ] [ expression ]
 
[expression]
selects  which  packets  will  be  dumped.   If  no expression is given, all packets on the net will be dumped.   
Otherwise, only packets for which expression is `true' will be dumped.

expression的表達式為這指令的精髓所在，使用表達式可以過濾並留下特定的packets，
避免資料量太多，不易分析並較容易發現問題點所在~是屬於比較進階的用法

The most important options of tcpdump are
■ -c number. Exit after receiving number of packets.
■ -F file. Use file as input for the filter expression. An additional expression given on the command line is ignored.
■ -i interface. Listen on interface.
■ -n. Do not convert addresses (such as host addresses or port numbers) to names.
■ -N. Do not print the domain name qualification of host names.
■ -S. Print absolute, rather than relative, TCP sequence numbers.
■ -w file. Write the raw packets to file rather than parsing and printing them out.

指令可以直接下tcpdump，ctrl+c 中斷，或在指令後方加上-v 或-vv 或-vvv 可以看到更詳細的內容
#tcpdump

抓到eth0的1000個packets後停止，並將結果存在/root/fileA這個檔案，大小n選項的意義請參照上面~
#tcpdump -i eth0 -c 1000 -w /root/fileA -nN

讀取檔案內容
#tcpdump -r /root/fileA

dst port 21為expression~功能為何請自行參照manual page
#tcpdump -i eth0 -nN -X -w /root/fileB dst port 21

結論：在文字環境下…tcpdump的確是不錯的工具~
如果覺得wireshark(ethereal)這類型的工具，光操作應用程式界面就很痛苦的話
那不彷開始使用tcpdump吧 >.<