tcpdump实例（tcpdump实例）.docVIP

tcpdump实例（tcpdump实例） Eighty-two million six hundred and fifty thousand six hundred and three Occasionally encountered at work, special records for future search use. The maintenance of a mail server, there are always found up to connect 25 ports, with some software, such as iptraf and Wireshark, etherape found that the effect is not ideal, or Tcpdump is more intuitive and convenient, such as TCP port 25 and host command tcpdump 211.147.1.11 awstat.txt, you can generate a detailed report of the connection. I think tcpdump is still very practical. Here are some examples to illustrate how it works (1) want to intercept all packets received and sent by all 210.27.48.1 hosts: #tcpdump host 210.27.48.1 (2) to intercept the communication between the host 210.27.48.1 and the host 210.27.48.2 or 210.27.48.3, and use the command (when using parentheses in the command line, be sure to escape) #tcpdump, host, 210.27.48.1, and \ \ (210.27.48.2, or, 210.27.48.3 \ \) (3) if you want to get the host 210.27.48.1, use the command in addition to the IP packet that all hosts communicate with the host 210.27.48.2: #tcpdump, IP, host, 210.27.48.1, and, 210.27.48.2! (4) if you want to get the SMTP packet received or sent by the host 210.27.48.1, use the following command: #tcpdump TCP port 25 and host 210.27.48.1 # this note, a lot of books are wrong, before there is a and, or syntax runtime error. (5) if the system is under suspicion of denial of service (Dos) attacks, the network administrator can intercept all ICMP sent to the machine to do the package, if there are a lot of Ping instructions to the server, you can order as follows: #tcpdump ICMP -n -i eth0 # use this command to test found only two DNS connections, is normal The output of tcpdump is introduced --------------------------------------------- Next, we describe the output information of several typical tcpdump commands (1) data link layer header information Use the command #tcpdump --e host ice Ice is a host with Linux, an