Tcpdump - Revision history

Anko: /* Примери */

2013-10-29T04:01:56Z

Примери

Anko: /* Примери */

2013-10-29T03:55:10Z

Примери

Anko: /* Примери */

2013-10-29T03:54:01Z

Примери

Anko: /* Примери */

2013-10-29T03:52:10Z

Примери

Anko: /* Примери */

2013-10-29T03:51:53Z

Примери

Anko: Created page with "http://www.tcpdump.org/tcpdump_man.html == Примери== TCPDUMP Section: User Commands (1) Updated: 12 July 2012 Index Return to Main Contents NAME tcpdump - dump traf..."

2013-10-29T03:45:36Z

Created page with "http://www.tcpdump.org/tcpdump_man.html == Примери== TCPDUMP Section: User Commands (1) Updated: 12 July 2012 Index Return to Main Contents NAME tcpdump - dump traf..."

Show changes

@@ Line 39: / Line 39: @@
 *tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
 TCPDUMP
@@ Line 58: / Line 61: @@
           [ -P in|out|inout ]
-          [ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
+          [ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [  ]
           [ -W filecount ]

@@ Line 14: / Line 14: @@
 To print all IP packets between ace and any host except helios:
-tcpdump ip host ace and not helios
+*tcpdump ip host ace and not helios
 To print all traffic between local hosts and hosts at Berkeley:
-tcpdump net ucb-ether
+*tcpdump net ucb-ether
 To print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell from (mis-)interpreting the parentheses):
-tcpdump 'gateway snup and (port ftp or ftp-data)'
+*tcpdump 'gateway snup and (port ftp or ftp-data)'
 To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net).
-tcpdump ip and not net localnet
+*tcpdump ip and not net localnet
 To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
-tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
+*tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
 To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets. (IPv6 is left as an exercise for the reader.)
-tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
+*tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
 To print IP packets longer than 576 bytes sent through gateway snup:
-tcpdump 'gateway snup and ip[2:2] > 576'
+*tcpdump 'gateway snup and ip[2:2] > 576'
 To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
-tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
+*tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
 To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):
-tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
+*tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
 TCPDUMP

@@ Line 5: / Line 5: @@
 Извеждане на всички пакети към/от хост с Адрес
-*'''''tcpdump host Address'''''
+*'''''tcpdump host address'''''
 Извеждане на трафика между хост с адрес и хостове IP1 и IP2

← Older revision		Revision as of 03:52, 29 October 2013
Line 9:		Line 9:
	Извеждане на трафика между хост с адрес и хостове IP1 и IP2		Извеждане на трафика между хост с адрес и хостове IP1 и IP2

−	*tcpdump host address and (IP1 or IP2)	+	*'''''tcpdump host address and (IP1 or IP2)'''''

@@ Line 3: / Line 3: @@
 == Примери==
 TCPDUMP
@@ Line 197: / Line 233: @@
 OUTPUT FORMAT