tcpdump usage

Synopsis

tcpdump [ -AbdDefhHIJKlLnNOpqStuUvxX# ] [ -B buffer_size ] 

         [ -c count ] [ -C file_size ] 
         [ -E spi@ipaddr algo:secret,... ] 
         [ -F file ] [ -G rotate_seconds ] [ -i interface ] 
         [ --immediate-mode ] [ -j tstamp_type ] [ -m module ] 
         [ -M secret ] [ --number ] [ --print ] [ -Q in|out|inout ] 
         [ -r file ] [ -s snaplen ] [ -T type ] [ --version ] 
         [ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ] 
         [ -z postrotate-command ] [ -Z user ] 
         [ --time-stamp-precision=tstamp_precision ] 
         [ expression ] 

Example

 # packets on eth0 interface
 tcpdump -i eth0

 # packets on any interface
 tcpdump -i any

 # tcp port 1935 packets on eth0 interface
 tcpdump -i eth0 tcp port 1935

 # tcp port 1935 packets including bodies on eth0 interface and write a file
 tcpdump -s 0 -l -w - -i eth0 "(tcp port 1935)" > /tmp/output.pcap

 # ((Destination IP == 192.168.0.2 && tcp port 1935) || tcp port 5521) on any interface
 tcpdump -i any "(dst 192.168.0.2 && tcp port 1935) or (tcp port 5521)"

 # (((Destination IP == 192.168.0.2 && tcp port 1935) || tcp port 5521) && TCP SYN packet) on any    interface

 tcpdump -i any "((dst 192.168.0.2) or (tcp port 5521)) and (tcp[tcpflags] & tcp-syn != 0)"


Reference

https://www.tcpdump.org/manpages/tcpdump.1.html

댓글

댓글 쓰기

이 블로그의 인기 게시물

Android essentials summary

- Binder Binder is android-specific inter-process communication mechanism and RPC mechanism. Android does not use traditional system V IPC and does use binder, which is efficient and fast. In order to provide efficient IPC, binder driver was added in linux kernel. And for app, AIDL was provided and app developers can develop binder client and server easily without coding the marshalling/unmarshalling stuffs. - ASHMEM Asynchronous shared memory was added to android linux kernel. Compared to system V shared memory, ashmem releases kernel resources when nobody refers the shared memory and kernel can reclaim unpinned shared memory when memory runs low. When app shares large amount of data to other app or service such as surface data and image, passing data by using shared memory does not need to copy data and therefore shared memory outperforms other methods like socket. - AIDL AIDL(Android Interface Definition Language) is a kind of IDL specific to android. AIDL defines programmin...
자세한 내용 보기

i++ vs ++i in C and C++

Prefer ++i over i++. In C language, there is no difference between ++i and i++. In C++, ++i has performance gain rather than i++ because of object copy. In detail, refer followings https://stackoverflow.com/questions/24853/what-is-the-difference-between-i-and-i https://stackoverflow.com/questions/24886/is-there-a-performance-difference-between-i-and-i-in-c
자세한 내용 보기

[Math] GCD & LCM

GCD(Greatest Common Divisor) & LCM(Least Common Multiple) 1. Find GCD of two number Method 1: use basic Euclidean algorithm. GCD(a, b) = GCD(b%a, a) Method 2: use extended Euclidean algorithm. GCD(a, b) = ax + by Let values of x and y calculated by the recursive call be x 1 and y 1 x = y 1 - ⌊b/a⌋ * x 1 y = x 1 2. Find LCM of two number LCM(a, b) * GCD(a, b) = a * b 3. Reference http://www.geeksforgeeks.org/mathematical-algorithms/#gcd
자세한 내용 보기