tcpdump官网

官网
请参考官网参看具体参数信息

tcpdump使用

tcpdump抓取http请求

http请求抓取参考网址

//抓取HTTP GET (GET = 0x47, 0x45, 0x54, 0x20) 请求,以ascii展示
tcpdump -i eth0 -A -s 0 ‘tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420’

//抓取HTTP POST (POST = 0x50, 0x4f, 0x53, 0x54) 请求,以ascii展示
tcpdump -i eth0 -A -s 0 ‘tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)’

//抓取网卡eth0下80端口的http请求和返回数据,以ascii展示
tcpdump -i eth0 -A -s 0 ‘tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’

//抓取网卡eth0下与www.baidu.com交互的http请求和返回数据,以ascii展示
tcpdump -i eth0 -A -s 0 ‘host www.baidu.com and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’

//抓取网卡eth0下与169.254.0.4交互的http请求和返回数据,以ascii展示
tcpdump -i eth0 -A -s 0 ‘host 169.254.0.4 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’