tcpdump

# List available network interfaces:
$ tcpdump -D

# Capture the traffic of a specific interface:
$ tcpdump -i eth0

# Capture all TCP traffic showing contents (ASCII) in console:
$ tcpdump -A tcp

# Capture the traffic from or to a host:
$ tcpdump host www.example.com

# Capture the traffic from a specific interface, source, destination and destination port:
$ tcpdump -i eth0 src 192.168.1.1 and dst 192.168.1.2 and dst port 80

# Capture the traffic of a network:
$ tcpdump net 192.168.1.0/24

# Capture all traffic except traffic over port 22 and save to a dump file:
$ tcpdump -w dumpfile.pcap port not 22

# Read from a given dump file:
$ tcpdump -r dumpfile.pcap

$ sudo tcpdump -i any -n -p tcp port 22
$ sudo tcpdump -i vmbr0 port 22

# 抓取 DNS 包
$ tcpdump -i en0 udp dst port 53

# 抓取 TCP 并且是 80 端口，目标 IP 是 192.168.1.254 或者 192.168.1.200
$ tcpdump -i en0 '((tcp) and (port 80)and ((dst host 192.168.1.254) or (dst host 192.168.1.200)))'

# 抓取 ICMP 包并且目标 MAC 地址是 00:01:02:03:04:05
$ tcpdump -i en0 '((icmp) and ((ether dst host00:01:02:03:04:05)))'

# 抓取 TCP 包并且网络段是 192.168 的，目标 IP 不是 192.168.1.200
$ tcpdump -i en0 '((tcp) and ((dst net192.168) and (not dst host 192.168.1.200)))'

# 只抓取 SYN 包
$ tcpdump -i en0 'tcp[tcpflags] = tcp-syn'

# 抓取 SYN 不等于 0 且 ACK 不等于 0 的包
$ tcpdump -i en0 'tcp[tcpflags] & tcp-syn != 0 andtcp[tcpflags] & tcp-ack != 0'

# 抓取 SMTP 包
$ tcpdump -i en0 '((port 25) and (tcp[(tcp[12]>>2):4] = 0x4d41494c))'

# 抓取 HTTP GET 包，GET 的十六进制是 47455420
$ tcpdump -i en0 'tcp[(tcp[12]>>2):4] = 0x47455420'

# 抓取 SSH 返回包，SSH-的十六进制是 0x5353482D
$ tcpdump -i en0 'tcp[(tcp[12]>>2):4] = 0x5353482D'

# 抓取旧版本的 SSH 返回包，SSH-1.99
$ tcpdump -i en0 '(tcp[(tcp[12]>>2):4] = 0x5353482D) and(tcp[((tcp[12]>>2)+4):2]= 0x312E)'

# 抓取 8000 端口的 GET 包，保存文件
$ tcpdump -i en0 '((port 8000) and (tcp[(tcp[12]>>2):4]=0x47455420))' -nnAl -w /tmp/GET.log

# 监听UDP上所有的DNS网络流量
$ tcpdump -i any -n -p udp port 53
# 取得关于一个IP地址的所有访问量
$ tcpdump host 8.8.8.8
# 把所有网络访问写入PCAP文件
$ tcpdump -i any -w output.txt
# 从PCAP文件读取所有网络访问
$ tcpdump -r  output.txt

# 监控80端口的数据包
$ tcpdump tcp port 80 -s 0 -w http.pcap

$ tcpdump -i ens33 -nn ip host 172.16.0.66 and host 172.16.0.67

$ tcpdump -i eth0 -s 1000 -w /tmp/tcpdump.cap

$ tcpdump -s 1024 -l -A port 8140 -i eth0 -vvvv

# 服务器抓包
$ tcpdump -Xnlp port 22

# net.ipv6.conf.wlp3s0.disable_ipv6 = 1
$ tcpdump -i wlp3s0 -Xnlp port 22

# 抓取HTTPS流量
$ tcpdump -s 0 -i eth0 port 443 and host 10.235.173.30 -w https.pcap

# 抓取mysql流量
$ tcpdump -s 65535 -x -nn -q -tttt -i any -c 1024 port 3306 > mysql-tcp.lo

# 监听vmbr0接口的ARP协议通信
$ sudo tcpdump -i vmbr0 arp

# 监听en0接口的所有通信。
$ sudo tcpdump -i enO

# 用ASCII显示en0接口的通信内容。
$ sudo tcpdump -A -i enO

# 显示enp2s0f0接口的22端口的通信。
$ sudo tcpdump -i enp2s0f0 'port 22'

# 显示eth1接口来自192.168.1.200的通信。
$ sudo tcpdump -i ethl src 192.168.1.200

# 显示eth1接口80端口、目的地为192.168.1.101的通信。
$ sudo tcpdump -i ethl dst 192.168.1.101 and port 80

# 将lo0接口的通信存入文件record.pcap
$ sudo tcpdump -w record.pcap -i lo0

# IP过滤
$ tcpdump -i en0 host 192.168.1.1
$ tcpdump -i en0 src host 192.168.1.1
$ tcpdump -i en0 dst host 192.168.1.1

# 端口过滤
$ tcpdump -i en0 port 25
$ tcpdump -i en0 src port 25
$ tcpdump -i en0 dst port 25

# 网络过滤
$ tcpdump -i en0 net 192.168
$ tcpdump -i en0 src net 192.168
$ tcpdump -i en0 dst net 192.168

# 协议过滤
$ tcpdump -i en0 arp
$ tcpdump -i en0 iptcpdump -i en0 tcp
$ tcpdump -i en0 udp
$ tcpdump -i en0 icmp

tcpdump [-AdDefLnNOpqRStuUvxX] [-c count] [-C fle_size] [-F fle] [-i interface] 
  [-m module][-M secret] [-r fle] [-s snaplen] [-T type] [-w fle] [-W flecount] 
  [-E spi@ipaddr algo:secret,...] [-y datalinktype] [-Z user] [expression]

tcpdump [-adeflnNOpqStvx] [-c 数量] [-F 文件名] [-i 网络接口] [-r 文件名] [-s snaplen] [-T 类型] [-w 文件名] [表达式]

TIMESTAMP SRC_IP:PORT> DEST_IP:PORT: NAME1 VALUE1, NAME2 VALUE2,...