{"id":21398,"date":"2026-10-23T16:44:33","date_gmt":"2026-10-23T08:44:33","guid":{"rendered":"https:\/\/blog.ywdevops.cn\/?p=21398"},"modified":"2026-10-23T18:43:12","modified_gmt":"2026-10-23T10:43:12","slug":"tcpdump","status":"publish","type":"post","link":"https:\/\/blog.ywdevops.cn\/index.php\/2026\/10\/23\/tcpdump\/","title":{"rendered":"tcpdump\u6293\u5305\u7528\u6cd5"},"content":{"rendered":"\n

\u4e00\u3001\u6293\u53d6\u4efb\u610f\u7f51\u5361\u63a5\u53e3\u7684\u5305\uff1a<\/p>\n\n\n\n

tcpdump -i any -nn port 80<\/code><\/pre>\n\n\n\n
\u4e0a\u8ff0\u547d\u4ee4\u7684\u610f\u601d\u662f\uff1a\u6293\u53d6\u6240\u6709\u7f51\u5361\u4e2d\u6e90\u7aef\u53e3\u6216\u76ee\u7684\u7aef\u53e3\u4e3a 80<\/strong> \u7684\u6570\u636e\u5305\uff0c\u5e76\u4ee5\u6570\u5b57\u5f62\u5f0f\u663e\u793a IP \u5730\u5740\u548c\u7aef\u53e3\u53f7\uff0c\u4e0d\u8fdb\u884c\u57df\u540d\u3001\u670d\u52a1\u540d\u89e3\u6790<\/p>\n\n\n\n
\u53c2\u6570\u9010\u9879\u8be6\u89e3\uff1a<\/p>\n\n\n\n
\u53c2\u6570<\/th>\u542b\u4e49<\/th><\/tr><\/thead>
tcpdump<\/code><\/td>Linux\/Unix \u4e0b\u5e38\u7528\u6293\u5305\u5de5\u5177\uff0c\u57fa\u4e8e libpcap\uff0c\u4f7f\u7528 BPF \u8fc7\u6ee4\u8868\u8fbe\u5f0f\u3002<\/td><\/tr>
-i any<\/code><\/td>\u6307\u5b9a\u6293\u5305\u63a5\u53e3\u4e3a any<\/code>\u3002\u5728 Linux \u4e0a\u8868\u793a\u6293\u53d6\u6240\u6709\u7f51\u7edc\u63a5\u53e3\u4e0a\u7684\u6d41\u91cf\uff0c\u5305\u62ec\u7269\u7406\u7f51\u5361\u3001\u865a\u62df\u7f51\u5361\u7b49\u3002any<\/code> \u662f\u4f2a\u63a5\u53e3\uff0c\u94fe\u8def\u5c42\u7c7b\u578b\u901a\u5e38\u662f Linux cooked capture\uff0c\u4e0d\u662f\u666e\u901a Ethernet \u5934\uff1b\u5e76\u4e14 any<\/code> \u901a\u5e38\u4e0d\u8fdb\u5165\u6df7\u6742\u6a21\u5f0f\u3002<\/td><\/tr>
port 80<\/code><\/td>BPF \u8fc7\u6ee4\u8868\u8fbe\u5f0f\u3002\u5339\u914d\u6e90\u7aef\u53e3\u6216\u76ee\u7684\u7aef\u53e3\u4e3a 80<\/strong> \u7684\u5305\uff0c\u7b49\u4ef7\u4e8e\uff1asrc port 80 or dst port 80<\/code>\u3002\u901a\u5e38\u662f TCP\/UDP \u7aef\u53e3\uff1b\u5982\u679c\u53ea\u60f3\u6293 TCP 80\uff0c\u5e94\u5199 tcp port 80<\/code>\u3002<\/td><\/tr>
-nn<\/code><\/td>\u5b9e\u9645\u662f\u4e24\u4e2a -n<\/code> \u53e0\u52a0\u3002\u7b2c\u4e00\u4e2a n<\/code> \u7981\u6b62\u628a IP \u5730\u5740\u53cd\u89e3\u4e3a\u4e3b\u673a\u540d\uff1b\u7b2c\u4e8c\u4e2a n<\/code> \u7981\u6b62\u628a\u7aef\u53e3\u53f7\u53cd\u89e3\u4e3a\u670d\u52a1\u540d\u3002\u4f8b\u5982\u7aef\u53e3 80<\/code> \u663e\u793a\u4e3a 80<\/code>\uff0c\u800c\u4e0d\u662f http<\/code>\u3002\u540c\u65f6\u53ef\u51cf\u5c11 DNS\/\u670d\u52a1\u67e5\u8be2\u5e26\u6765\u7684\u5ef6\u8fdf\u3002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u672c\u5730\u901a\u8fc7\u6d4f\u89c8\u5668\u8bbf\u95ee49.224:80\u7aef\u53e3\uff0c\u4e3e\u4f8b\u5982\u4e0b\uff1a<\/p>\n\n\n\n
[root@www ~]# tcpdump -i any port 80 -nn\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\nlistening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes\n1. 15:56:52.637193 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [S], seq 2351164921, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0\n2. 15:56:52.637385 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [S.], seq 107526675, ack 2351164922, win 64240, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0\n3. 15:56:52.638340 IP 10.9.4.253.59150 > 192.168.49.224.80: Flags [S], seq 2621911150, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0\n4. 15:56:52.638377 IP 192.168.49.224.80 > 10.9.4.253.59150: Flags [S.], seq 2193990366, ack 2621911151, win 64240, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0\n5. 15:56:52.638813 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 1, win 255, length 0\n6. 15:56:52.639121 IP 10.9.4.253.59150 > 192.168.49.224.80: Flags [.], ack 1, win 255, length 0\n7. 15:56:52.639582 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [P.], seq 1:571, ack 1, win 255, length 570: HTTP: GET \/ HTTP\/1.1\n8. 15:56:52.639617 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [.], ack 571, win 498, length 0\n9. 15:56:52.640250 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 1:352, ack 571, win 498, length 351: HTTP: HTTP\/1.1 302 Moved Temporarily\n10. 15:56:52.658744 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [P.], seq 571:1150, ack 352, win 254, length 579: HTTP: GET \/sign-sys\/ HTTP\/1.1\n11. 15:56:52.659308 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 352:7652, ack 1150, win 494, length 7300: HTTP: HTTP\/1.1 200 OK\n12. 15:56:52.659566 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 7652:13492, ack 1150, win 494, length 5840: HTTP\n13. :56:52.659726 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 13492:14565, ack 1150, win 494, length 1073: HTTP\n14. 15:56:52.659869 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 3272, win 255, length 0\n15. 15:56:52.659869 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 7652, win 255, length 0\n16. 15:56:52.660047 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 10572, win 255, length 0\n17. 15:56:52.660047 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 13492, win 255, length 0\n18. 15:56:52.660180 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 14565, win 251, length 0\n19. 15:56:52.726180 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [P.], seq 1150:1644, ack 14565, win 251, length 494: HTTP: GET \/sign-sys\/css\/app.593b4c90.css HTTP\/1.1\n20. 15:56:52.730263 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 14565:29165, ack 1644, win 491, length 14600: HTTP: HTTP\/1.1 200 OK\n21. 15:56:52.730594 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 29165:31230, ack 1644, win 491, length 2065: HTTP\n22. 15:56:52.731043 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 24785, win 255, length 0\n23. 15:56:52.731229 IP 10.9.4.253.50796 > 192.168.49.224.80: Flags [.], ack 31230, win 255, length 0\n24. 15:56:52.734447 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 31230:50210, ack 1644, win 491, length 18980: HTTP\n25. 15:56:52.734787 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [P.], seq 50210:69190, ack 1644, win 491, length 18980: HTTP\n26. 15:56:52.734978 IP 192.168.49.224.80 > 10.9.4.253.50796: Flags [.], seq 69190:70650, ack 1644, win 491, length 1460: HTTP<\/code><\/pre>\n\n\n\n
\u7b2c\u4e00\u9636\u6bb5\uff1aTCP \u4e09\u6b21\u63e1\u624b\uff08\u5efa\u7acb\u8fde\u63a5\uff09\uff0c1-6\u884c\uff1a\u5b9e\u9645\u662f\u5b8c\u6210\u4e862\u6b21\u5e76\u53d1TCP\u8fde\u63a5\uff0c1\u30012\u30015\u884c\u4e3a\u4e00\u6b21\uff0c3\u30014\u30016\u884c\u4e3a\u4e00\u6b21<\/p>\n\n\n\n
    \n
  • [S]<\/code>\uff1a\u5ba2\u6237\u7aef\u53d1\u9001 SYN \u5305\uff0c\u8bf7\u6c42\u5efa\u7acb\u8fde\u63a5\u3002\u643a\u5e26\u4e86 MSS\uff08\u6700\u5927\u62a5\u6587\u6bb5\u957f\u5ea6 1460\uff09\u3001wscale 8\uff08\u7a97\u53e3\u7f29\u653e\u56e0\u5b50\uff09\u3001sackOK\uff08\u652f\u6301\u9009\u62e9\u6027\u786e\u8ba4\uff09\u7b49 TCP \u9009\u9879<\/li>\n\n\n\n
  • [S.]<\/code>\uff1a\u670d\u52a1\u5668\u56de\u590d SYN-ACK\uff0c\u643a\u5e26\u81ea\u5df1\u7684\u5e8f\u5217\u53f7\u548c wscale 7<\/code><\/li>\n\n\n\n
  • [.]<\/code>\uff1a\u5ba2\u6237\u7aef\u56de\u590d\u7eaf ACK \u786e\u8ba4\u3002\u8fde\u63a5\u5efa\u7acb\u5b8c\u6210<\/strong><\/li>\n<\/ul>\n\n\n\n
      <\/ul>\n\n\n\n
      \u7b2c\u4e8c\u9636\u6bb5\uff1aHTTP \u8bf7\u6c42\u4e0e 302 \u91cd\u5b9a\u5411\uff08\u4e1a\u52a1\u903b\u8f91\uff09\uff0c\u670d\u52a1\u5668\u548c\u5ba2\u6237\u7aef\u5f00\u59cb\u8fdb\u884c HTTP \u5bf9\u8bdd<\/p>\n\n\n\n
        \n
      • \u7b2c7\u884c\uff1a\u5ba2\u6237\u7aef 50796<\/code> \u53d1\u8d77\u8bf7\u6c42\uff1alength 570: HTTP: GET \/ HTTP\/1.1<\/code>\uff0c\u8bf4\u660e\u5ba2\u6237\u7aef\u5728\u8bf7\u6c42\u7f51\u7ad9\u7684\u6839\u76ee\u5f55 \/<\/code><\/li>\n\n\n\n
      • \u7b2c 8 \u884c<\/strong>\uff1a\u670d\u52a1\u5668\u56de\u590d ACK\uff0c\u786e\u8ba4\u6536\u5230\u8bf7\u6c42<\/li>\n\n\n\n
      • \u7b2c 10 \u884c<\/strong>\uff1a\u670d\u52a1\u5668\u8fd4\u56de\u54cd\u5e94\uff1alength 351: HTTP: HTTP\/1.1 302 Moved Temporarily<\/code>\uff0c\u670d\u52a1\u5668\u544a\u8bc9\u5ba2\u6237\u7aef\uff1a\u201c\u4f60\u8981\u627e\u7684\u6839\u76ee\u5f55\u88ab\u4e34\u65f6\u79fb\u52a8\u4e86\uff08\u901a\u5e38\u662f\u56e0\u4e3a HTTP \u8df3\u8f6c HTTPS\uff0c\u6216\u8005\u8df3\u8f6c\u5230\u5e26\u6709\u533a\u57df\/\u8bed\u8a00\u524d\u7f00\u7684\u8def\u5f84\uff09\u201d<\/li>\n\n\n\n
      • \u7b2c 13 \u884c<\/strong>\uff1a\u5ba2\u6237\u7aef 50796<\/code> \u6839\u636e 302 \u7684\u63d0\u793a\uff0c\u53d1\u8d77\u7b2c\u4e8c\u6b21\u8bf7\u6c42\uff1alength 579: HTTP: GET \/sign-sys\/ HTTP\/1.1<\/code>\uff0c\u8bf4\u660e\u9875\u9762\u6700\u7ec8\u843d\u811a\u70b9\u5728 \/sign-sys\/<\/code> \u8fd9\u4e2a\u8def\u5f84<\/li>\n\n\n\n
      • \u7b2c 14 \u884c<\/strong>\uff1a\u670d\u52a1\u5668\u56de\u590d ACK\uff0c\u5269\u4e0b\u7684\u5176\u4ed6\u884c\u4ee5\u6b64\u7c7b\u63a8<\/li>\n<\/ul>\n\n\n\n
        \u7b26\u53f7\u8bb2\u89e3\uff1a<\/p>\n\n\n\n
        1\u3001[S]<\/code> \u2014\u2014 SYN (Synchronize Sequence Numbers)<\/p>\n\n\n\n
          \n
        • \u4e2d\u6587\u542b\u4e49<\/strong>\uff1a\u540c\u6b65\u5e8f\u5217\u53f7<\/li>\n\n\n\n
        • \u5b9e\u9645\u4f5c\u7528<\/strong>\uff1a\u53d1\u8d77\u8fde\u63a5\u8bf7\u6c42<\/strong><\/li>\n\n\n\n
        • \u573a\u666f<\/strong>\uff1a\u5f53\u5ba2\u6237\u7aef\u60f3\u8981\u548c\u670d\u52a1\u5668\u5efa\u7acb\u8fde\u63a5\u65f6\uff0c\u4f1a\u53d1\u9001\u5e26\u6709 S<\/code> \u6807\u5fd7\u7684\u5305\u3002\u76f8\u5f53\u4e8e\u5728\u6572\u95e8\uff1a\u201c\u5582\uff0c\u4f60\u5728\u5417\uff1f\u6211\u60f3\u548c\u4f60\u5efa\u7acb\u8fde\u63a5\uff0c\u6211\u7684\u521d\u59cb\u5e8f\u53f7\u662f XXX\u201d\u3002<\/li>\n<\/ul>\n\n\n\n
          2\u3001[S.]<\/code> \u2014\u2014 SYN + ACK (Synchronize + Acknowledge)<\/p>\n\n\n\n
            \n
          • \u4e2d\u6587\u542b\u4e49<\/strong>\uff1a\u540c\u6b65 + \u786e\u8ba4<\/li>\n\n\n\n
          • \u6ce8\u610f<\/strong>\uff1atcpdump \u7528\u82f1\u6587\u53e5\u53f7 .<\/code> \u6765\u4ee3\u8868 ACK<\/code>\uff08\u786e\u8ba4\uff09\u6807\u5fd7\uff0c\u8fd9\u662f\u4e3a\u4e86\u8f93\u51fa\u754c\u9762\u66f4\u7b80\u6d01<\/li>\n\n\n\n
          • \u5b9e\u9645\u4f5c\u7528<\/strong>\uff1a\u540c\u610f\u8fde\u63a5\u5e76\u56de\u590d<\/strong><\/li>\n\n\n\n
          • \u573a\u666f<\/strong>\uff1a\u670d\u52a1\u5668\u6536\u5230 [S]<\/code> \u540e\uff0c\u4f1a\u56de\u590d\u4e00\u4e2a [S.]<\/code> \u5305\u3002\u76f8\u5f53\u4e8e\u670d\u52a1\u5668\u5f00\u95e8\u56de\u5e94\uff1a\u201c\u6211\u5728\uff0c\u6211\u540c\u610f\u5efa\u7acb\u8fde\u63a5\uff0c\u6211\u7684\u521d\u59cb\u5e8f\u53f7\u662f YYY\uff0c\u6211\u4e5f\u6536\u5230\u4e86\u4f60\u521a\u624d\u7684\u5e8f\u53f7 XXX\u201d<\/li>\n<\/ul>\n\n\n\n
            3\u3001[.]<\/code> \u2014\u2014 ACK (Acknowledge)<\/p>\n\n\n\n
              \n
            • \u4e2d\u6587\u542b\u4e49<\/strong>\uff1a\u786e\u8ba4<\/li>\n\n\n\n
            • \u5b9e\u9645\u4f5c\u7528<\/strong>\uff1a\u8868\u793a\u201c\u6211\u6536\u5230\u4e86\u201d<\/strong>\u3002\u5b83\u76f8\u5f53\u4e8e\u65e5\u5e38\u804a\u5929\u91cc\u7684\u201c\u70b9\u5934\u201d\u6216\u201c\u55ef\u201d\u4e00\u58f0\uff0c\u8bc1\u660e\u6570\u636e\u5b89\u5168\u9001\u8fbe\uff0c\u6ca1\u6709\u643a\u5e26\u4efb\u4f55\u4e1a\u52a1\u6570\u636e\uff08\u6240\u4ee5\u4f60\u770b\u540e\u9762\u5e38\u5e38\u8ddf\u7740 length 0<\/code>\uff09<\/li>\n\n\n\n
            • \u4e09\u6b21\u63e1\u624b\u6700\u540e\u4e00\u6b65<\/strong>\uff1a\u5ba2\u6237\u7aef\u56de\u590d [.]<\/code>\uff0c\u8868\u793a\u6211\u6536\u5230\u4f60\u7684\u540c\u610f\u4e86\uff0c\u8fde\u63a5\u6b63\u5f0f\u5efa\u7acb<\/li>\n\n\n\n
            • \u6570\u636e\u63a5\u6536\u786e\u8ba4<\/strong>\uff1a\u4f60\u622a\u56fe\u4e2d\u540e\u534a\u6bb5\u8fde\u7eed\u51fa\u73b0\u597d\u51e0\u884c [.]<\/code>\uff0c\u8fd9\u662f\u5ba2\u6237\u7aef\u5728\u5411\u670d\u52a1\u5668\u786e\u8ba4\uff1a\u201c\u4f60\u53d1\u6765\u7684\u524d\u9762 7300 \u5b57\u8282\u6211\u6536\u5230\u4e86\u201d\u3001\u201c\u524d\u9762 13492 \u5b57\u8282\u6211\u4e5f\u6536\u5230\u4e86\u201d\u3002<\/li>\n<\/ul>\n\n\n\n
              4\u3001[P.]<\/code> \u2014\u2014 PSH + ACK (Push + Acknowledge)<\/p>\n\n\n\n
                \n
              • \u4e2d\u6587\u542b\u4e49<\/strong>\uff1a\u63a8\u9001 + \u786e\u8ba4<\/li>\n\n\n\n
              • \u5b9e\u9645\u4f5c\u7528<\/strong>\uff1a\u643a\u5e26\u771f\u5b9e\u7684\u4e1a\u52a1\u6570\u636e\u5e76\u7acb\u5373\u63a8\u9001\u7ed9\u5e94\u7528\u5c42<\/strong><\/li>\n\n\n\n
              • \u573a\u666f<\/strong>\uff1a\u5f53\u6709\u771f\u6b63\u7684\u6570\u636e\uff08\u6bd4\u5982 HTTP \u8bf7\u6c42\u5934\u3001\u7f51\u9875 HTML \u4ee3\u7801\u3001\u56fe\u7247\u5185\u5bb9\uff09\u9700\u8981\u53d1\u9001\u65f6\uff0c\u5c31\u4f1a\u6253\u4e0a P<\/code> \u6807\u5fd7\u3002\u5b83\u544a\u8bc9\u63a5\u6536\u65b9\u7684\u64cd\u4f5c\u7cfb\u7edf\uff1a\u201c\u8fd9\u4e2a\u5305\u91cc\u6709\u5e94\u7528\u5c42\u7684\u6570\u636e\uff0c\u522b\u5728\u7f13\u51b2\u533a\u91cc\u6392\u961f\u4e86\uff0c\u8d76\u7d27\u4ea4\u7ed9\u4f60\u4e0a\u9762\u7684\u5e94\u7528\u7a0b\u5e8f\uff08\u6bd4\u5982\u6d4f\u89c8\u5668\/Web\u670d\u52a1\u5668\uff09\u5904\u7406\uff01\u201d \u540c\u65f6\u5e26 .<\/code>\uff08ACK\uff09\uff0c\u8868\u793a\u6211\u4e5f\u786e\u8ba4\u6536\u5230\u4e86\u4f60\u7684\u4e0a\u4e00\u4e2a\u5305<\/li>\n\n\n\n
              • \u4e0a\u56fe\u4e2d<\/strong>\uff1a\u53ea\u8981\u770b\u5230\u65b9\u62ec\u53f7\u91cc\u5e26\u6709 P<\/code>\uff0c\u6bd4\u5982 [P.]<\/code>\uff0c\u5e76\u4e14\u540e\u9762\u7684 length<\/code>\uff08\u957f\u5ea6\uff09\u5927\u4e8e 0\uff0c\u6216\u8005\u540e\u9762\u8ddf\u7740 HTTP:<\/code> \u5b57\u6837\uff0c\u8fd9\u5c31\u4ee3\u8868\u6b63\u5728\u4f20\u8f93\u5b9e\u9645\u7684\u7f51\u9875\u8bf7\u6c42\u6216\u7f51\u9875\u5185\u5bb9<\/li>\n<\/ul>\n\n\n\n
                5\u3001[F.]<\/code> (FIN)<\/strong>\uff1aFinish\uff0c\u8868\u793a\u65ad\u5f00\u8fde\u63a5<\/strong>\uff08\u56db\u6b21\u6325\u624b\uff09<\/p>\n\n\n\n
                6\u3001[R]<\/code> (RST)<\/strong>\uff1aReset\uff0c\u8868\u793a\u91cd\u7f6e\u8fde\u63a5<\/strong>\uff08\u901a\u5e38\u662f\u8fde\u63a5\u88ab\u5f02\u5e38\u5f3a\u5236\u5173\u95ed\uff0c\u6bd4\u5982\u670d\u52a1\u5668\u62d2\u7edd\u4e86\u8bf7\u6c42\uff09<\/p>\n\n\n\n
                \u4e8c\u3001\u6293\u53d6\u5b8c\u6574\u7684\u5305\uff0c\u5e76\u4fdd\u5b58\uff0c\u5982\u4e0b\uff1a<\/p>\n\n\n\n
                # \u6293\u53d6\u6307\u5b9a\u7f51\u5361\u7684\u5b8c\u6574\u5305\u5e76\u4fdd\u5b58\ntcpdump -i eth0 host 192.168.1.1 -w \/tmp\/capture.pcap<\/code><\/pre>\n\n\n\n
                \u5982\u679c\u8981\u67e5\u770b\u8fd9\u4e2apcap\u6587\u4ef6\uff0c\u4e5f\u53ef\u4ee5\u4f7f\u7528tcpdump\u547d\u4ee4\uff0c\u5982\u4e0b\uff1a<\/p>\n\n\n\n
                # \u57fa\u7840\u67e5\u770b\uff08\u548c\u4f60\u521a\u624d\u6293\u5305\u770b\u5230\u7684\u683c\u5f0f\u4e00\u6a21\u4e00\u6837\uff09\ntcpdump -nn -r capture.pcap\n\n# \u52a0\u4e0a\u8fc7\u6ee4\u6761\u4ef6\uff0c\u53ea\u770b 80 \u7aef\u53e3\ntcpdump -nn -r capture.pcap 'port 80'\n\n# \u76f4\u63a5\u67e5\u770b HTTP \u660e\u6587\u5185\u5bb9\uff08\u52a0 -A \u53c2\u6570\uff09\ntcpdump -nn -A -r capture.pcap 'port 80'\n\n# \u5982\u679c\u6587\u4ef6\u5f88\u5927\uff0c\u53ea\u770b\u524d 20 \u4e2a\u5305\ntcpdump -nn -r capture.pcap -c 20<\/code><\/pre>\n\n\n\n
                \u6ce8\uff1apcap\u6587\u4ef6\u8fd8\u53ef\u4ee5\u4f7f\u7528Wireshark\u548c\u00a0tshark(Wireshark \u7684\u547d\u4ee4\u884c\u7248) \u67e5\u770b<\/p>\n","protected":false},"excerpt":{"rendered":"
                \u4e00\u3001\u6293\u53d6\u4efb\u610f\u7f51\u5361\u63a5\u53e3\u7684\u5305\uff1a \u4e0a\u8ff0\u547d\u4ee4\u7684\u610f\u601d\u662f\uff1a\u6293\u53d6\u6240\u6709\u7f51\u5361\u4e2d\u6e90\u7aef\u53e3\u6216\u76ee\u7684\u7aef\u53e3\u4e3a 80 \u7684\u6570\u636e\u5305\uff0c\u5e76\u4ee5\u6570\u5b57\u5f62\u5f0f\u663e […]<\/p>\n","protected":false},"author":3,"featured_media":21401,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-21398","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/comments?post=21398"}],"version-history":[{"count":13,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21398\/revisions"}],"predecessor-version":[{"id":21420,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21398\/revisions\/21420"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media\/21401"}],"wp:attachment":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media?parent=21398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/categories?post=21398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/tags?post=21398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}