[20200227]使用tcpdump or and ()語法問題.txt
[20200227]使用tcpdump or and ()語法問題.txt
--//這幾天使用tcpdump調式網路,遇到一點點問題,做一個記錄。
# tcpdump -nnn -i eth0 port 15210 or host 192.168.100.40 and not port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:09:22.699011 IP 192.168.100.40.1521 > 192.168.100.78.65202: . ack 3859187154 win 154
16:09:22.699164 IP 192.168.100.78.15210 > 192.168.98.6.65202: . ack 3859187154 win 154
16:09:22.699372 IP 192.168.98.6.65202 > 192.168.100.78.15210: . ack 1 win 16288
16:09:22.699393 IP 192.168.100.78.65202 > 192.168.100.40.1521: . ack 1 win 16288
--//實際上上面的過濾條件並不是我實際需要的。我實際想表達的是:
( port 15210 or host 192.168.100.40 ) and not port 514
--//只不過當時的過濾輸出已經滿足解決問題需要,我當時沒有過多探究。
# tcpdump -nnn -i eth0 (port 15210 or host 192.168.100.40 ) and not port 514
-bash: syntax error near unexpected token `('
--//不能使用()嗎?實際上bash shell上使用(),要加入\轉義以下。
# tcpdump -nnn -i eth0 \( port 15210 or host 192.168.100.40 \) and not port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:12:48.152788 IP 192.168.98.6.65202 > 192.168.100.78.15210: P 3859187154:3859187673(519) ack 425548478 win 16288
16:12:48.152933 IP 192.168.100.78.65202 > 192.168.100.40.1521: P 3859187154:3859187673(519) ack 425548478 win 16288
16:12:48.154236 IP 192.168.100.40.1521 > 192.168.100.78.65202: P 1:737(736) ack 519 win 154
16:12:48.154277 IP 192.168.100.78.15210 > 192.168.98.6.65202: P 1:737(736) ack 519 win 154
--//實際上看tcpdump 手冊,可以發現例子,還可以使用單引號解決這個問題:
# tcpdump -nnn -i eth0 '(port 15210 or host 192.168.100.40 ) and not port 514'
EXAMPLES
To print all packets arriving at or departing from sundown:
tcpdump host sundown
To print traffic between helios and either hot or ace:
tcpdump host helios and \( hot or ace \)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To print all IP packets between ace and any host except helios:
tcpdump ip host ace and not helios
To print all traffic between local hosts and hosts at Berkeley:
tcpdump net ucb-ether
To print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell
from (mis-)interpreting the parentheses):
tcpdump 'gateway snup and (port ftp or ftp-data)'
To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff
should never make it onto your local net).
tcpdump ip and not net localnet
To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example,
SYN and FIN packets and ACK-only packets. (IPv6 is left as an exercise for the reader.)
tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
To print IP packets longer than 576 bytes sent through gateway snup:
tcpdump 'gateway snup and ip[2:2] > 576'
To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):
tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
--//tcpdump 功能很強大,後面這些例子基本沒有使用過。
來自 “ ITPUB部落格 ” ,連結:http://blog.itpub.net/267265/viewspace-2677501/,如需轉載,請註明出處,否則將追究法律責任。
相關文章
- goroutine 語法問題Go
- [20181217]strace使用問題.txt
- [20210303]bbed使用小問題.txt
- [20181227]bbed的使用問題.txt
- [20181101]使用putty無法登入redhat 7.X版本問題.txtRedhat
- [20211221]分析sql語句遇到的問題.txtSQL
- [20210902]cut使用輸出問題.txt
- [20190314]使用strace注意的問題.txt
- [20230905]奇怪的語法.txt
- Tcpdump使用示例TCP
- [20221010]使用toad管理索引改名問題.txt索引
- [20191118]使用Chrome瀏覽器問題.txtChrome瀏覽器
- [20220324]toad與sql profile使用問題.txtSQL
- [20200402]strace過濾使用awk問題.txt
- [20181119]使用sql profile優化問題.txtSQL優化
- [20180412]logminer使用問題(10g).txt
- latex 語法塊中字型加粗問題、換行問題
- [20221101]tmux使用問題copy和paste失效.txtUXAST
- [20211220]記錄使用sqlplus的小問題.txtSQL
- [20190221]使用nmap掃描埠的問題.txt
- [20180420]windows下使用cmd的小問題.txtWindows
- TcpDump使用手冊TCP
- [20230329]記錄除錯sql語句遇到的問題.txt除錯SQL
- [20211229]toad下優化sql語句注意的問題.txt優化SQL
- [20180912]關於ANSI joins語法.txt
- [20240309]在windwos下使用sed遇到的問題.txt
- [20220517]toad使用gather_plan_statistics提示問題.txt
- [20210929]sql打補丁使用rule提示問題.txtSQL
- [20181006]12c使用toad連線問題.txt
- VMware Fusion 13無法使用問題
- mysql8.0 部分sql語法報錯問題MySql
- [20210812]windows xcopy問題.txtWindows
- [20190221]sql patch 問題.txtSQL
- [20181204]bbed修改問題.txt
- [20190313]備份問題.txt
- [20180619]bbed verify問題.txt
- 關於debian系統下使用vi編輯語法不高亮的問題
- [20231029]使用cygwin調式bash shell引出的問題.txt