10.10 linux下抓包

監控系統狀態

• 抓包工具 tcpdump
• 用法：tcpdump -nn
• tcpdump -nn -i ens33
• tcpdump -nn port 80
• tcpdump -nn not port 22 and host 192.168.0.100
• tcpdump -nn -c 100 -w 1.cap
• tshark -n -t a -R http.request -T fields -e "frame.time" -e "ip.src" -e "http.host" -e "http.request.method" -e "http.request.uri"
• yum install -y wireshark

tcpdump命令

• tcpdump命令，是用來抓包的
• 安裝tcpdump包——>yum install -y tcpdump
• tcp -nn -i eno16777736
  • 第一個n，表示你的ip用數字的形式顯示出來（如果不加，則會顯示出主機名）

[root@hf-01 ~]# tcpdump -nn
tcpdump: packet printing is not supported for link type NFLOG: use -w
[root@hf-01 ~]# ifconfig
eno16777736: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.74.129  netmask 255.255.255.0  broadcast 192.168.74.255
        inet6 fe80::20c:29ff:feff:fe93  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:ff:fe:93  txqueuelen 1000  (Ethernet)
        RX packets 11067  bytes 12250186 (11.6 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2631  bytes 312427 (305.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@hf-01 ~]# tcpdump -nn -i eno16777736 
5204, ack 6605, win 159, length 180
06:27:41.186368 IP 192.168.74.129.22 > 192.168.74.1.49322: Flags [P.], seq 45955204:45955384, ack 6605, win 159, length 180
06:27:41.186422 IP 192.168.74.129.22 > 192.168.74.1.49322: Flags [P.], seq 45955384:45955564, ack 6605, win 159, length 180
等等等，運行後，會顯示出不少的信息
按ctrl+c退出

• DDos攻擊
  • udp flood叫udp的洪水攻擊
    • 在遇到這種攻擊的時候，只能接入防攻擊的設備（好比：創宇--300G是能夠頂住的）

tcpdump命令指定端口

• tcpdump -nn -i eno16777736 port 22

[root@hf-01 ~]# tcpdump -nn -i eno16777736 port 22
4, length 0
06:52:04.034073 IP 192.168.74.129.22 > 192.168.74.1.49322: Flags [P.], seq 228004:228376, ack 1, win 159, length 372
06:52:04.034155 IP 192.168.74.129.22 > 192.168.74.1.49322: Flags [P.], seq 228376:228556, ack 1, win 159, length 180
06:52:04.034302 IP 192.168.74.1.49322 > 192.168.74.129.22: Flags [.], ack 228556, win 252, length 0
06:52:04.034387 IP 192.168.74.129.22 > 192.168.74.1.49322: Flags [P.], seq 228556:228832, ack 1, win 159, length 276
等等等，只截取了一部分

tcpdump命令使用排除法

• tcpdump -nn not port 22 and host 192.168.0.100 除去22端口和只要ip爲192.168.0.100的包

tcpdump命令指定長度和個數

• tcpdump -nn -i eno16777736 -c 100 -w 1.cap 指定數據包只要10個，並存入到1.cap文件中去
  • 在終端查看的時候，不產生一些數據量的話，就不會產生那麼多數據包
• file 1.cap 查看該文件——>文件名稱能夠隨意更改
  • 能查看文件的大概信息
  • 該文件不能直接 cat命令 查看的，會出現亂碼
    • 由於1.cap這個文件就是從你網卡里捕捉到的數據包，就是你通訊的那個數據

在這裏複製另外一個終端，並打開，跑vmstat 1命令

在當前終端查看，輸入如下命令
[root@hf-01 ~]# tcpdump -nn -i eno16777736 -c 10 -w 1.cap
tcpdump: listening on eno16777736, link-type EN10MB (Ethernet), capture size 262144 bytes
10 packets captured
10 packets received by filter
0 packets dropped by kernel
[root@hf-01 ~]# file 1.cap
1.cap: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 262144)
[root@hf-01 ~]#

• 若要查看這個文件，則能夠tcpdump -r 1.cap
  • -r 表示讀

[root@hf-01 ~]# tcpdump -r 1.cap    //查看1.cap文件
reading from file 1.cap, link-type EN10MB (Ethernet)
07:02:05.134302 IP 192.168.74.129.ssh > 192.168.74.1.49322: Flags [P.], seq 4218852344:4218852492, ack 3076966380, win 159, length 148
07:02:05.134859 IP 192.168.74.1.49322 > 192.168.74.129.ssh: Flags [.], ack 148, win 255, length 0
07:02:05.257655 IP 192.168.74.129.ssh > 192.168.74.1.49322: Flags [P.], seq 148:280, ack 1, win 159, length 132
07:02:05.462113 IP 192.168.74.1.49322 > 192.168.74.129.ssh: Flags [.], ack 280, win 255, length 0
07:02:06.258704 IP 192.168.74.129.ssh > 192.168.74.1.49322: Flags [P.], seq 280:428, ack 1, win 159, length 148
07:02:06.462164 IP 192.168.74.1.49322 > 192.168.74.129.ssh: Flags [.], ack 428, win 254, length 0
07:02:07.259714 IP 192.168.74.129.ssh > 192.168.74.1.49322: Flags [P.], seq 428:560, ack 1, win 159, length 132
07:02:07.460218 IP 192.168.74.1.49322 > 192.168.74.129.ssh: Flags [.], ack 560, win 254, length 0
07:02:08.260717 IP 192.168.74.129.ssh > 192.168.74.1.49322: Flags [P.], seq 560:708, ack 1, win 159, length 148
07:02:08.460263 IP 192.168.74.1.49322 > 192.168.74.129.ssh: Flags [.], ack 708, win 253, length 0
[root@hf-01 ~]#

• 在read的返回的時候，是數據流，從哪到哪（包括tcpdump -nn屏幕上顯示的也是數據流）
• 而tcpdump -r的時候，寫入的是真正的數據包

tshark命令

• tshark命令
• 安裝tshark包——>yum install -y wireshark
• tshark和tcpdump相似的工具，也是用來抓包的
• tshark -n -t a -R http.request -T fields -e "frame.time" -e "ip.src" -e "http.host" -e "http.request.method" -e "http.request.uri" 查看指定網卡，80端口的一個web訪問狀況
  • 相似於web的訪問日誌