☰

CentOS 监听网络上的一切

tag-icon • tag-icon networking
CentOS 监听网络上的一切

我知道 Linux 上有一个本机命令，它将输出（到 stdout）与特定网络接口（eth0 等）相关的每个“事件”。
就像tail -f <file>监听文件更改一样。
我只是找不到它。

我想查看所有事件、传入数据包，甚至丢弃的数据包。尽可能低级别。在每个协议（TCP、UDP 等）中。
我认为 WireShark 有点太大了，因为我需要一些非常简单的东西来查看事件，它用于测试。

命令是什么？

答案1

正如其他人所提到的，您正在谈论 tcpdump。

还有ngrep：

$ yum info ngrep
Loaded plugins: fastestmirror, priorities
Available Packages
Name       : ngrep
Arch       : i386
Version    : 1.45
Release    : 2.el5.rf
Size       : 33 k
Repo       : dag
Summary    : Realtime network grep tool
URL        : http://ngrep.sourceforge.net/
License    : GPL
Description: ngrep is grep command that works on realtime network data.
           : 
           : ngrep strives to provide most of GNU grep's common features, applying
           : them to the network layer. ngrep is a pcap-aware tool that will allow
           : you to specify extended regular or hexadecimal expressions to match
           : against data payloads of packets. It currently recognizes TCP, UDP
           : and ICMP across Ethernet, PPP, SLIP, FDDI, Token Ring and null
           : interfaces, and understands bpf filter logic in the same fashion as
           : more common packet sniffing tools, such as tcpdump and snoop.

这有点像网络流上的 grep。它不是标准包，但它可以帮助您找到所需的网络流量。

答案2

TCPDUMP？

[root@kerberos users]# tcpdump -i virbr0 port 22 -c 10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on virbr0, link-type EN10MB (Ethernet), capture size 65535 bytes
10 packets captured
10 packets received by filter
0 packets dropped by kernel
18:15:00.629145 IP kerberos.example.com.ssh > 10.5.50.220.60680: Flags [P.], seq 723634149:723634341, ack 2691792940, win 145, options [nop,nop,TS val 2845703615 ecr 994376021], length 192
18:15:00.646606 IP 10.5.50.220.60680 > kerberos.example.com.ssh: Flags [.], ack 0, win 65535, options [nop,nop,TS val 994376068 ecr 2845703587], length 0
18:15:00.653646 IP 10.5.50.220.65416 > kerberos.example.com.ssh: Flags [.], ack 4059311404, win 33108, options [nop,nop,TS val 994376075 ecr 2845703594], length 0
18:15:00.659078 IP 10.5.50.220.65416 > kerberos.example.com.ssh: Flags [P.], seq 0:96, ack 1, win 33156, options [nop,nop,TS val 994376075 ecr 2845703594], length 96
18:15:00.660041 IP kerberos.example.com.ssh > 10.5.50.220.65416: Flags [P.], seq 1:129, ack 96, win 244, options [nop,nop,TS val 2845703645 ecr 994376075], length 128
18:15:00.676094 IP 10.5.50.220.60680 > kerberos.example.com.ssh: Flags [.], ack 192, win 65535, options [nop,nop,TS val 994376096 ecr 2845703615], length 0
18:15:00.706762 IP 10.5.50.220.65416 > kerberos.example.com.ssh: Flags [.], ack 129, win 33092, options [nop,nop,TS val 994376126 ecr 2845703645], length 0
18:15:00.712138 IP 10.5.50.220.65416 > kerberos.example.com.ssh: Flags [P.], seq 96:192, ack 129, win 33156, options [nop,nop,TS val 994376126 ecr 2845703645], length 96
18:15:00.713242 IP kerberos.example.com.ssh > 10.5.50.220.65416: Flags [P.], seq 129:257, ack 192, win 244, options [nop,nop,TS val 2845703699 ecr 994376126], length 128
18:15:00.760791 IP 10.5.50.220.65416 > kerberos.example.com.ssh: Flags [.], ack 257, win 33092, options [nop,nop,TS val 994376179 ecr 2845703699], length 0

答案3

我想您可能正在寻找tcpdump。

相关内容