tcpdump Demo

lxw ~$ tcpdump -i eth0
tcpdump: eth0: You don't have permission to capture on that device
(socket: Operation not permitted)
lxw ~$ sudo tcpdump -i eth0 -c #-i指定监听接口interface -c指定监听个数
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size bytes
::32.336082 IP6 fe80:::2ee6:ac6f:c9a4. > ff02:::.hostmon: UDP, length
::32.336178 IP 192.168.236.1. > 224.0.0.252.hostmon: UDP, length
packets captured
packets received by filter
packets dropped by kernel
lxw ~$ sudo tcpdump -i eth0 -c -w 20141227_1546.pcap #-w写入文件
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size bytes
packets captured
packets received by filter
packets dropped by kernel
lxw ~$ tcpdump -r 20141227_1546.pcap #-r从文件中读取
reading from file 20141227_1546.pcap, link-type EN10MB (Ethernet)
::20.602350 IP 192.168.236.156. > 192.168.236.2.domain: + A? tiles.services.mozilla.com. ()
::20.603151 IP 192.168.236.156. > 192.168.236.2.domain: + AAAA? tiles.services.mozilla.com. ()
::20.606409 IP 192.168.236.156. > 192.168.236.2.domain: + A? tiles.services.mozilla.com. ()
lxw ~$ sudo tcpdump -i eth0 -tttt #-t/-tt/-ttt/-tttt/-ttttt时间戳（各个含义，参见man tcpdump)
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size bytes
-- ::15.480571 IP 192.168.236.156. > assets-ubuntu-com.eggfruit.canonical.com.http: Flags [.], ack , win , length
…
packets captured
packets received by filter
packets dropped by kernel
lxw **~$ sudo tcpdump -i eth0 arp #指定抓包的协议类型（ip/ip6/arp/tcp/udp)
lxw ~$ sudo tcpdump -i eth0 tcp and port **#指定抓包端口port tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size bytes
::46.460864 IP 192.168.236.156. > 59.24.3.173.http: Flags [S], seq , win , options [mss ,sackOK,TS val ecr ,nop,wscale ], length
lxw ~$ sudo tcpdump -i eth0 tcp and src 192.168.236.156 and port

Reference:

tcpdump使用9个实例: http://blog.csdn.net/zj0910/article/details/12869977