![如何在无头服务器上为单个进程创建数据包捕获文件?](https://linux22.com/image/626120/%E5%A6%82%E4%BD%95%E5%9C%A8%E6%97%A0%E5%A4%B4%E6%9C%8D%E5%8A%A1%E5%99%A8%E4%B8%8A%E4%B8%BA%E5%8D%95%E4%B8%AA%E8%BF%9B%E7%A8%8B%E5%88%9B%E5%BB%BA%E6%95%B0%E6%8D%AE%E5%8C%85%E6%8D%95%E8%8E%B7%E6%96%87%E4%BB%B6%EF%BC%9F.png)
我正在无头服务器上编写 python 脚本,我想查看该脚本的数据包捕获输出。
我无法在服务器上运行 ettercap 或 Wireshark,因为有太多其他噪音(此外,wireshark 是一个 GUI 工具)。但是我有 sudo 访问权限。
有什么方法可以只捕获该脚本生成的数据包?最好是可以加载到 Wireshark 中的格式(不是强制性的,但是,如果需要,我可以仔细阅读文本)
答案1
Wireshark 有一个命令行实用程序。我曾在只有控制台访问权限的远程计算机上使用过它,它工作得很好。只需花几分钟阅读参数即可学会如何使用它。
C:\Program Files (x86)\Wireshark>dumpcap.exe -h
Dumpcap 1.10.3 (SVN Rev 53022 from /trunk-1.10)
Capture network packets and dump them into a pcapng file.
See http://www.wireshark.org for more information.
Usage: dumpcap [options] ...
Capture interface:
-i <interface> name or idx of interface (def: first non-loopback),
or for remote capturing, use one of these formats:
rpcap://<host>/<interface>
TCP@<host>:<port>
-f <capture filter> packet filter in libpcap filter syntax
-s <snaplen> packet snapshot length (def: 65535)
-p don't capture in promiscuous mode
-B <buffer size> size of kernel buffer in MB (def: 2MB)
-y <link type> link layer type (def: first appropriate)
-D print list of interfaces and exit
-L print list of link-layer types of iface and exit
-d print generated BPF code for capture filter
-k set channel on wifi interface <freq>,[<type>]
-S print statistics for each interface once per second
-M for -D, -L, and -S, produce machine-readable output
RPCAP options:
-r don't ignore own RPCAP traffic in capture
-u use UDP for RPCAP data transfer
-A <user>:<password> use RPCAP password authentication
-m <sampling type> use packet sampling
count:NUM - capture one packet of every NUM
timer:NUM - capture no more than 1 packet in NUM ms
Stop conditions:
-c <packet count> stop after n packets (def: infinite)
-a <autostop cond.> ... duration:NUM - stop after NUM seconds
filesize:NUM - stop this file after NUM KB
files:NUM - stop after NUM files
Output (files):
-w <filename> name of file to save (def: tempfile)
-g enable group read access on the output file(s)
-b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
filesize:NUM - switch to next file after NUM KB
files:NUM - ringbuffer: replace after NUM files
-n use pcapng format instead of pcap (default)
-P use libpcap format instead of pcapng
Miscellaneous:
-N <packet_limit> maximum number of packets buffered within dumpcap
-C <byte_limit> maximum number of bytes used for buffering packets wi
thin dumpcap
-t use a separate thread per interface
-q don't report packet capture counts
-v print version information and exit
-h display this help and exit
Example: dumpcap -i eth0 -a duration:60 -w output.pcapng
"Capture packets from interface eth0 until 60s passed into output.pcapng"
Use Ctrl-C to stop capturing at any time.
答案2
是的,您可以使用 iptables 和 dumpcap。概括:
# iptables -A OUTPUT -m owner --pid-owner 1000 -j CONNMARK --set-mark 1
# iptables -A INPUT -m connmark --mark 1 -j NFLOG --nflog-group 30
# iptables -A OUTPUT -m connmark --mark 1 -j NFLOG --nflog-group 30
# dumpcap -i nflog:30 -w pid-1000.pcap
这将捕获所有进程 ID 为 1000 的流量。这些命令必须在主机本身上运行(PID 信息所在的位置)。
答案3
另一种选择是通过dumpcap
SSH 将输出传输到本地机器上运行的 wireshark 中。
wireshark -k -i <(ssh -l USER REMOTEHOST "dumpcap -i lo -P -w - -f 'not tcp port 22'")
这将在本地打开 wireshark 实例,显示来自远程计算机的流量。您可能希望修改过滤器,not tcp port 22
以防止在网络上传输过多流量。