Tcpdump

ph
이동: 둘러보기, 검색

tcpdump -nS dst port <some port>

SYNOPSIS
       tcpdump [ -AbdDefhHIJKlLnNOpqRStuUvxX ] [ -B buffer_size ] [ -c count ]
               [ -C file_size ] [ -G rotate_seconds ] [ -F file ]
               [ -i interface ] [ -j tstamp_type ] [ -m module ] [ -M secret ]
               [ -P in|out|inout ]
               [ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
               [ -W filecount ]
               [ -E spi@ipaddr algo:secret,...  ]
               [ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
               [ expression ]
-n     Don't  convert  host  addresses  to  names.  This can be used to
              avoid DNS lookups.
-S     Print absolute, rather than relative, TCP sequence numbers.
expression
              selects which packets will  be  dumped.   If  no  expression  is
              given,  all  packets on the net will be dumped.  Otherwise, only
              packets for which expression is `true' will be dumped.

              For the expression syntax, see pcap-filter(7).

Allowable primitives are:

       dst host host
       src host host
       host host
       ether dst ehost
       ether src ehost
       ether host ehost
       gateway host
       dst net net
       src net net
       net net
       net net mask netmask
       net net/len
       dst port port
       src port port
       port port
       dst portrange port1-port2
       src portrange port1-port2
       portrange port1-port2
       less length
       greater length
       ip proto protocol
       ip6 proto protocol
       proto protocol
       tcp, udp, icmp
       ip6 protochain protocol
       ip protochain protocol
       protochain protocol
       ether broadcast
       ip broadcast
       ether multicast
       ip multicast
       ip6 multicast
       ether proto protocol
       ip, ip6, arp, rarp, atalk, aarp, decnet, iso, stp, ipx, netbeui
       lat, moprc, mopdl
       decnet src host
       decnet dst host
       decnet host host
       ifname interface
       on interface
       rnr num
       rulenum num
       reason code
       rset name
       ruleset name
       srnr num
       subrulenum num
       action act
       wlan ra ehost
       wlan ta ehost
       wlan addr1 ehost
       wlan addr2 ehost
       wlan addr3 ehost
       wlan addr4 ehost
       type wlan_type
       type wlan_type subtype wlan_subtype
       subtype wlan_subtype
       dir dir
       vlan [vlan_id]
       mpls [label_num]
       pppoed
       pppoes [session_id]
       iso proto protocol
       clnp, esis, isis
       l1, l2, iih, lsp, snp, csnp, psnp
       vpi n
       vci n
       lane
       llc
       oamf4s
       oamf4e
       oamf4
       oam
       metac
       bcc
       sc
       ilmic
       connectmsg
       metaconnect
       expr relop expr