以下是我的 PCAP 文件的输出。
20:02:52.306161 192.162.70.150.58078 > 192.179.91.61.1194: P 635362993:635363048(55) ack 2046024708 win 4373 <nop,nop,timestamp 52993632 1059054949> (DF)
20:02:52.532863 192.179.91.61.1194 > 192.162.70.150.58078: . ack 55 win 32038 <nop,nop,timestamp 1059062357 52993632> (DF)
20:02:53.157004 802.1d unknown version
20:02:54.759542 arp who-has 192.168.70.34 tell 192.168.70.1
20:02:55.156980 802.1d unknown version
20:02:55.759507 arp who-has 192.168.70.6 tell 192.168.70.1
20:02:55.759540 arp who-has 192.168.70.105 tell 192.168.70.1
20:02:56.148167 192.179.91.61.1194 > 192.168.70.150.58078: P 1:56(55) ack 55 win 32038 <nop,nop,timestamp 1059065972 52993632> (DF)
20:02:56.148258 192.168.70.150.58078 > 192.179.91.61.1194: . ack 56 win 4373 <nop,nop,timestamp 52994592 1059065972> (DF)
有没有办法过滤掉以下模式中的内容
Timestamp | source IP | source Port | destination IP | destination port | protocol | packet size
可用命令：tcpdump，，，，，tcpslicetcpstattcpproftcpparse