tcpdump

• Introduction

  • wiki:

  tcpdump 是一個執行在命令列下的嗅探工具。它允許用戶攔截和顯示傳送或收到過網路連接到該電腦的TCP/IP和其他封包。tcpdump 是一個在BSD授權條款下釋出的自由軟體。

  • tcpdump vs Wireshark
    • tcpdump : CLI tool
    • Wireshark : gui tool
    • More: What is the difference between Tcpdump and Wireshark?

• Common Use

  • How to install tcpdump?
    • Ans: default installed in Linux
  • Man page of TCPDUMP

  tcpdump -h # simply lookup tcpdump

  

  man tcpdump # detail of tcpdump

  

  

• Why split pcap:
  • for advaced analysis
    • Ex : DoS_HTTP
      
• split pcap

tcpdump -r old_file -w new_files -C 10 # 每個檔案切成 大約 10MB

• Others: Linux ls -lh :: 233M

h 是指用可讀性較好的單位來換算

• Resource:
  • HOW TO: Split huge Wireshark/TCPDump pcap files into smaller files
  • how to split a pcap file into a set of smaller ones