structtm { int tm_sec; /* seconds */ int tm_min; /* minutes */ int tm_hour; /* hours */ int tm_mday; /* day of the month */ int tm_mon; /* month */ int tm_year; /* year */ int tm_wday; /* day of the week */ int tm_yday; /* day in the year */ int tm_isdst; /* daylight saving time */ }; /* The members of the tm structure are: tm_sec The number of seconds after the minute, normally in the range 0 to 59, but can be up to 60 to allow for leap seconds. tm_min The number of minutes after the hour, in the range 0 to 59. tm_hour The number of hours past midnight, in the range 0 to 23. tm_mday The day of the month, in the range 1 to 31. tm_mon The number of months since January, in the range 0 to 11. tm_year The number of years since 1900. tm_wday The number of days since Sunday, in the range 0 to 6. tm_yday The number of days since January 1, in the range 0 to 365. tm_isdst A flag that indicates whether daylight saving time is in effect at the time described. The value is positive if daylight saving time is in effect, zero if it is not, and negative if the information is not available. */
intclock_gettime(clockid_t clk_id, struct timespec *tp); /* clk_id 有以下五种取值，我只用过前2个，后面3个待研究。 CLOCK_REALTIME // 获取实时时间,类似time() System-wide real-time clock. Setting this clock requires appropriate privileges. CLOCK_MONOTONIC // 获取系统从启动到现在经历的时间 Clock that cannot be set and represents monotonic time since some unspecified starting point. CLOCK_MONOTONIC_RAW (since Linux 2.6.28; Linux-specific) Similar to CLOCK_MONOTONIC, but provides access to a raw hardware- based time that is not subject to NTP adjustments. CLOCK_PROCESS_CPUTIME_ID High-resolution per-process timer from the CPU. CLOCK_THREAD_CPUTIME_ID Thread-specific CPU-time clock. */
sudo tcpdump -i eth0 port 19648 sudo tcpdump -i eth0 src port 19648 sudo tcpdump -i eth0 dst port 19648
这个和上面的IP过滤是相似的格式，不用多解释。
3、IP和端口组合过滤
与
1 2 3
sudo tcpdump -i eth0 dst host 192.168.202.92 and port 80 # 既包含特定的IP又要包含特定的端口 sudo tcpdump -i eth0 src host 192.168.202.92 and port 80 # 既包含特定的源IP又要包含特定的端口 sudo tcpdump -i eth0 dst host 192.168.202.92 and dst port 80 # 既包含特定的目的IP又要包含特定的目的端口
这个组合就是对上面的IP和端口过滤的方式进行组合，这里使用 and 关键字，表示与的意思。
或
同时还有 or 关键字，or表示或的意思。
1
sudo tcpdump -i eth0 dst host 192.168.202.92 or port 19761 # 满足条件之一即可
非
1 2 3
sudo tcpdump -i eth0 not dst host 192.168.202.92 # 过滤目的IP不是192.168.202.92的数据包 sudo tcpdump -i eth0 not dst host 192.168.202.92 and not port 80 # 过滤目的IP不是192.168.202.92同时端口不是80的 sudo tcpdump -i eth0 dst host 192.168.202.92 or not src port 80 # 过滤目的IP是192.168.202.92 或者 源端口不是80的
4、协议过滤
协议过滤，常用的协议有ip，arp，tcp，udp，icmp等等，只需要和上面的方式进行组合即可。
1 2 3
sudo tcpdump -i eth0 udp # 过滤所有UDP包 sudo tcpdump -i eth0 udp and host 192.168.202.92 # 过滤ip是192.168.202.92的udp包 sudo tcpdump -i eth0 udp and host 192.168.202.92 and port 40948 # 过滤ip是192.168.202.92且端口是40948的udp包
其他的组合方式类似。
以上的包过滤方式，我认为已经可以解决大多数问题了。下面介绍一下其他的参数使用。
包输出
1、保存包到文件
有时候需要将抓到的包写入文件，然后再用wireshark打开分析。
1
sudo tcpdump -w udp.pacp -i eth0 udp
这里使用 -w 参数，将过滤到包保存到udp.pcap文件中。
2、指定包的数量
-c 指定过滤一定数量的包
1 2 3 4 5 6 7 8
[KentZhang@local103-122 ~]$ sudo tcpdump -c 2 -i eth0 udp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 11:39:01.511005 IP server.ha.xss.com.syslog > 10.10.100.252.syslog: SYSLOG cron.info, length: 97 11:39:01.511415 IP server.ha.boyaa.com.42251 > dc01.boyaa.com.domain: 18958+ PTR? 252.100.10.10.in-addr.arpa. (44) 2 packets captured 7 packets received by filter 0 packets dropped by kernel
3、显示IP和端口号
1 2 3 4 5 6 7
[KentZhang@local103-122 ~]$ sudo tcpdump -i eth0 udp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 11:26:34.504652 IP server.ha.com.syslog > 10.10.100.252.syslog: SYSLOG daemon.info, length: 50 11:26:34.505276 IP server.ha.com.syslog > 10.10.100.252.syslog: SYSLOG user.info, length: 43 11:26:34.505788 IP server.ha.com.syslog > 10.10.100.252.syslog: SYSLOG user.info, length: 44 11:26:34.506273 IP server.ha.com.syslog > 10.10.100.252.syslog: SYSLOG user.info, length: 43
