抓取服務器上TCP報文

抓取導入到文件1.cap裏： sudo tcpdump -i em1 -s 0 -w 1.cap

發送到桌面用wireshark查看：sz 1.cap

參考連接：http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html

e.g. 

sudo tcpdump  -i eth1 dst port ! 22 and src port ! 22 and host 192.168.1.220 -s 0 -w ./chat.cap

sudo tcpdump -i em1 host 192.168.1.112 -s 0 -w chat.cap