tcpdump 的抓包保存到文件的命令参数是-w xxx.cap
1
| tcpdump -i eth1 -w /tmp/xxx.pcap
|
1
| tcpdump -i eth1 -nn -w /tmp/xxx.pcap
|
1
| tcpdump -i eth1 host 192.168.1.123 -w /tmp/xxx.cap
|
1
| tcpdump -i eth1 host 192.168.1.123 and port 80 -w /tmp/xxx.cap
|
1
| tcpdump -i eth1 host 192.168.1.123 and icmp -w /tmp/xxx.cap
|
- 抓192.168.1.123的80端口和110和25以外的其他端口的包
1
| tcpdump -i eth1 host 192.168.1.123 and ! port 80 and ! port 25 and ! port 110 -w /tmp/xxx.cap
|
1
| tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap
|
1
| tcpdump -i eth1 pppoes -w /tmp/xxx.cap
|
- 以100m大小分割保存文件， 超过100m另开一个文件
1
| tcpdump -i eth1 -w /tmp/xxx.cap -C 100m
|
1
| mergecap -w merge.pcap 1.pcap 2.pcap
|
1
| tshark -r 1.pcap radius -w radius.pcap
|
1
| editcap -c 1000000 merge.pcap split01.pcap
|
1
| editcap -c 100000 in.pcap out.pcap
|