ITPub博客

首页 > Linux操作系统 > Linux操作系统 > [20200227]使用tcpdump or and ()语法问题.txt

[20200227]使用tcpdump or and ()语法问题.txt

原创 Linux操作系统 作者:lfree 时间:2020-02-27 16:26:13 0 删除 编辑

[20200227]使用tcpdump or and ()语法问题.txt

--//这几天使用tcpdump调式网络,遇到一点点问题,做一个记录。

# tcpdump -nnn -i eth0 port 15210 or host 192.168.100.40  and not port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:09:22.699011 IP 192.168.100.40.1521 > 192.168.100.78.65202: . ack 3859187154 win 154
16:09:22.699164 IP 192.168.100.78.15210 > 192.168.98.6.65202: . ack 3859187154 win 154
16:09:22.699372 IP 192.168.98.6.65202 > 192.168.100.78.15210: . ack 1 win 16288
16:09:22.699393 IP 192.168.100.78.65202 > 192.168.100.40.1521: . ack 1 win 16288

--//实际上上面的过滤条件并不是我实际需要的。我实际想表达的是:
( port 15210 or host 192.168.100.40 )  and not port 514

--//只不过当时的过滤输出已经满足解决问题需要,我当时没有过多探究。

# tcpdump -nnn -i eth0 (port 15210 or host 192.168.100.40 )  and not port 514
-bash: syntax error near unexpected token `('

--//不能使用()吗?实际上bash shell上使用(),要加入\转义以下。

# tcpdump -nnn -i eth0 \( port 15210 or host 192.168.100.40 \)  and not port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:12:48.152788 IP 192.168.98.6.65202 > 192.168.100.78.15210: P 3859187154:3859187673(519) ack 425548478 win 16288
16:12:48.152933 IP 192.168.100.78.65202 > 192.168.100.40.1521: P 3859187154:3859187673(519) ack 425548478 win 16288
16:12:48.154236 IP 192.168.100.40.1521 > 192.168.100.78.65202: P 1:737(736) ack 519 win 154
16:12:48.154277 IP 192.168.100.78.15210 > 192.168.98.6.65202: P 1:737(736) ack 519 win 154

--//实际上看tcpdump 手册,可以发现例子,还可以使用单引号解决这个问题:
# tcpdump -nnn -i eth0 '(port 15210 or host 192.168.100.40 ) and not port 514'

EXAMPLES
       To print all packets arriving at or departing from sundown:
              tcpdump host sundown

       To print traffic between helios and either hot or ace:
              tcpdump host helios and \( hot or ace \)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       To print all IP packets between ace and any host except helios:
              tcpdump ip host ace and not helios

       To print all traffic between local hosts and hosts at Berkeley:
              tcpdump net ucb-ether

       To print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell
       from (mis-)interpreting the parentheses):
              tcpdump 'gateway snup and (port ftp or ftp-data)'

       To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff
      should never make it onto your local net).
              tcpdump ip and not net localnet

       To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
              tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

       To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example,
       SYN and FIN packets and ACK-only packets.  (IPv6 is left as an exercise for the reader.)
              tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

       To print IP packets longer than 576 bytes sent through gateway snup:
              tcpdump 'gateway snup and ip[2:2] > 576'

       To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
              tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'

       To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):
              tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'

--//tcpdump 功能很强大,后面这些例子基本没有使用过。

来自 “ ITPUB博客 ” ,链接:http://blog.itpub.net/267265/viewspace-2677501/,如需转载,请注明出处,否则将追究法律责任。

请登录后发表评论 登录
全部评论
熟悉oracle相关技术,擅长sql优化,rman备份与恢复,熟悉linux shell编程。

注册时间:2008-01-03

  • 博文量
    2668
  • 访问量
    6425997