常用命令:
tcpdump -s 0 -i any -w tcpdump.cap
参数解释及实例:
Last login: Fri Mar 8 15:56:07 2019 from 172.16.22.65 [root@localhost ~]# tcpdump -h tcpdump version 4.1-PRE-CVS_2012_03_26 libpcap version 1.4.0 Usage: tcpdump [-aAdDefIKlLnNOpqRStuUvxX] [ -B size ] [ -c count ] [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ] [ -i interface ] [ -M secret ] [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ] [ -Z user ] [ expression ] # -i 是指定要抓取的网卡 # -w 指定要保存的位置 [root@localhost ~]# tcpdump -s 0 -i any -w tcpdump.scp tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes ^C280 packets captured 324 packets received by filter 0 packets dropped by kernel