Linux command
tcpdump 命令
文本
复制后可按需替换文件名、目录或参数。
常用示例
Capture packets
tcpdump
Capture on specific interface
tcpdump -i [eth0]
Capture only packets
tcpdump host [192.168.1.1]
Capture packets
tcpdump port [80]
Capture and save
tcpdump -w [capture.pcap]
Read packets
tcpdump -r [capture.pcap]
Capture with verbose output
tcpdump -v
Capture HTTP traffic
tcpdump -A port [80]
Capture packets
tcpdump icmp
Capture limited number
tcpdump -c [100]
Don't resolve hostnames
tcpdump -n
说明
tcpdump is a packet analyzer that captures and displays network traffic. It uses libpcap to capture packets from network interfaces and can filter traffic using Berkeley Packet Filter (BPF) syntax. The tool can capture packets in real-time, display their contents in various formats, and save them to files for later analysis. Output can show packet headers, full content, or hexadecimal dumps. tcpdump is essential for network troubleshooting, security analysis, and protocol debugging. It's the command-line counterpart to graphical tools like Wireshark.
参数
- -i _interface_
- Capture on specific interface.
- -w _file_
- Write packets to file.
- -r _file_
- Read packets from file.
- -c _count_
- Capture only count packets.
- -n
- Don't resolve hostnames.
- -nn
- Don't resolve hostnames or ports.
- -v, -vv, -vvv
- Verbose output levels.
- -A
- Print packets in ASCII.
- -X
- Print packets in hex and ASCII.
- -s _snaplen_
- Capture snaplen bytes per packet (0=full).
- -e
- Print link-layer header.
- -q
- Quick output (less protocol info).
- -D, --list-interfaces
- List available interfaces.
- -t
- Don't print timestamp on each line.
- -tt
- Print unformatted timestamp on each line.
- -p, --no-promiscuous-mode
- Don't put the interface into promiscuous mode.
- -F _file_
- Use file as input for the filter expression.
FAQ
What is the tcpdump command used for?
tcpdump is a packet analyzer that captures and displays network traffic. It uses libpcap to capture packets from network interfaces and can filter traffic using Berkeley Packet Filter (BPF) syntax. The tool can capture packets in real-time, display their contents in various formats, and save them to files for later analysis. Output can show packet headers, full content, or hexadecimal dumps. tcpdump is essential for network troubleshooting, security analysis, and protocol debugging. It's the command-line counterpart to graphical tools like Wireshark.
How do I run a basic tcpdump example?
Run `tcpdump` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -i _interface_ do in tcpdump?
Capture on specific interface.