☰

如何让 tcpdump 将其捕获的每个数据包写入文件？

tag-icon • tag-icon tcpdump
如何让 tcpdump 将其捕获的每个数据包写入文件？

我正在运行以下版本的 tcpdump：

  • tcpdump 版本 4.0.0
  • libpcap 版本 1.0.0

我想让 tcpdump 将其捕获的每个数据包写入文件。目前，只有退出 tcpdump 才能看到捕获的数据包。

tcpdump -i em1 -w /tmp/pkts.pcap -s 1500

我需要退出才能打开/tmp/pkts.pcap- 在此之前我假设 tcpdump 正在缓冲。有没有办法让 tcpdump 立即写入文件而不是缓冲？

答案1

-U将选项与选项结合使用-w，并检查您是否拥有支持 的 libcap 版本pcap_dump_flush()。从手册页（版本 4.3.0-1）：

   -U     If  the  -w  option  is  not  specified,  make  the  printed packet output ``packet-
          buffered''; i.e., as the description of the contents of each packet is  printed,  it
          will be written to the standard output, rather than, when not writing to a terminal,
          being written only when the output buffer fills.

          If the -w option is specified, make the saved raw packet output ``packet-buffered'';
          i.e.,  as  each  packet is saved, it will be written to the output file, rather than
          being written only when the output buffer fills.

          The -U flag will not be supported if tcpdump was built  with  an  older  version  of
          libpcap that lacks the pcap_dump_flush() function.

相关内容