Don’t translate foreign IPv4 address Don’t translate foreign IPv4 address “-f “ option tells tcpdump not translate foreign IPv4 address. Use tcpdump to monitor packets from ...

Rotate capture files Rotate capture files To rotate capture files, “-C file_size “ (the unit is MB , i.e., 1,000,000 Bytes) option can be used to set the size of rotation file...

Save packets into file Save packets into file “-w file “ option is used to save capture packets into a file instead of printing them in standard output: # tcpdump -w enp0s3....

Print link level header Print link level header “-e “ option can be used to print link level header, e.g., MAC address. Compare the output without & with “-e “: # tcpdump ...

Specify network interfaces Specify network interfaces “-D/--list-interfaces “ option is used to show available network interfaces: # tcpdump -D 1.enp0s3 [ Up , Running...

Limit capture packet count Limit capture packet count “-c count “ will limit the number of capture packets. E.g.: # tcpdump -c 1 tcpdump : verbose output suppressed , u...

Print absolute TCP sequence number Print absolute TCP sequence number “-S/--absolute-tcp-sequence-numbers “ option tells tcpdump print absolute, rather than relative, TCP seq...

Print less protocol information Print less protocol information “-q “ option makes tcpdump output quickly, i.e., print less protocol information: # tcpdump -q tcpdump : ...

5.5 封包撷取功能 5.5.1 文字接口封包撷取器： tcpdump 5.5.2 图形接口封包撷取器： wireshark 5.5.3 任意启动 TCP/UDP 封包的埠口联机： nc, netcat 5.5 封包撷取功能 很多时候由于我们的网络联机出现问题，使用类似 ping 的软件功能却又无法找出问题点，最常见的是因为路由与 IP 转递后...

Don’t put the interface into promiscuous mode Don’t put the interface into promiscuous mode “-p/--no-promiscuous-mode “ option tells tcpdump not put the interface into promisc...