linux下简单抓包分析
有时候会遇到一些问题需要我们来抓包分析，当手头又没有专业的抓包工具的时候，可以用tcpdump来替代一下（一般的发行版都自带这个工具）
比如我们要分析一下eth0接口下跟192.168.7.188 这个目的IP地址22端口的发包情况
tcpdump -i eth0 dst 192.168.7.188 and port 22
tcpdump -i eth0 dst 192.168.7.188 and port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:51:55.861670 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 2209699250:2209699442, ack 582840950, win 249, options [nop,nop,TS val 428468844 ecr 517889], length 192
16:51:55.868590 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 192:416, ack 1, win 249, options [nop,nop,TS val 428468851 ecr 517897], length 224
16:51:55.870577 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 416:624, ack 1, win 249, options [nop,nop,TS val 428468853 ecr 517899], length 208
16:51:55.872602 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 624:832, ack 1, win 249, options [nop,nop,TS val 428468855 ecr 517899], length 208
16:51:55.874576 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 832:1040, ack 1, win 249, options [nop,nop,TS val 428468857 ecr 517900], length 208
16:51:55.876573 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1040:1248, ack 1, win 249, options [nop,nop,TS val 428468859 ecr 517900], length 208
16:51:55.878574 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1248:1456, ack 1, win 249, options [nop,nop,TS val 428468861 ecr 517901], length 208
16:51:55.880574 IP 192.168.7.26.ssh > 192.168.7.188.37540: Flags [P.], seq 1456:1664, ack 1, win 249, options [nop,nop,TS val 428468863 ecr 517901], length 208
郑重声明：本站内容如果来自互联网及其他传播媒体，其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享，并不代表本站赞同其观点和对其真实性负责，也不构成任何其他建议。
