linux下简单抓包分析

作者: 小和尚
来源: 51数据库
2020-09-13

有时候会遇到一些问题需要我们来抓包分析，当手头又没有专业的抓包工具的时候，可以用tcpdump来替代一下（一般的发行版都自带这个工具）

比如我们要分析一下eth0接口下跟192.168.7.188 这个目的IP地址22端口的发包情况

tcpdump -i eth0 dst 192.168.7.188 and port 22

tcpdump -i eth0 dst 192.168.7.188 and port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:51:55.861670 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 2209699250:2209699442, ack 582840950, win 249, options [nop,nop,TS val 428468844 ecr 517889], length 192
16:51:55.868590 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 192:416, ack 1, win 249, options [nop,nop,TS val 428468851 ecr 517897], length 224
16:51:55.870577 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 416:624, ack 1, win 249, options [nop,nop,TS val 428468853 ecr 517899], length 208
16:51:55.872602 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 624:832, ack 1, win 249, options [nop,nop,TS val 428468855 ecr 517899], length 208
16:51:55.874576 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 832:1040, ack 1, win 249, options [nop,nop,TS val 428468857 ecr 517900], length 208
16:51:55.876573 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1040:1248, ack 1, win 249, options [nop,nop,TS val 428468859 ecr 517900], length 208
16:51:55.878574 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1248:1456, ack 1, win 249, options [nop,nop,TS val 428468861 ecr 517901], length 208
16:51:55.880574 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1456:1664, ack 1, win 249, options [nop,nop,TS val 428468863 ecr 517901], length 208