tcpdump 抓包

admin

sudo tcpdump -i bond1.104 -v -vv -t   
! A) [4 z, L: M3 J! Z
1 _5 E7 l- O- s& W( y. E6 T3 @& v! }
sudo tcpdump -i ens1f0 -vv -w /tmp/ens1f0.cap     抓包写如文件中
% s( C5 \$ L6 O* b; _

admin

sudo tcpdump -i bond1.104 -vvv -t
tcpdump: WARNING: bond1.104: no IPv4 address assigned
+ Z2 W7 Y' Y! D7 J* {1 S& f( _' dtcpdump: listening on bond1.104, link-type EN10MB (Ethernet), capture size 65535 bytes
/ T/ b% |+ x, lIP (tos 0x0, ttl 64, id 18437, offset 0, flags [DF], proto ICMP (1), length 84)
. I8 t- _4 R" |4 V- w    CD--6 > 10.64.35.100: ICMP echo request, id 7024, seq 437, length 64
IP (tos 0x0, ttl 64, id 18437, offset 0, flags [DF], proto ICMP (1), length 84)
. J6 L% ^8 ], s  X! Y" S7 r    10.4.5.100 > CD--6: ICMP echo reply, id 7024, seq 437, length 64
0 W$ B& i" [- q+ ^- X0 P$ [IP (tos 0x0, ttl 64, id 18696, offset 0, flags [DF], proto ICMP (1), length 84)
& Q& n4 w8 E7 t+ W    CD--6 > 10.4.5.100: ICMP echo request, id 7024, seq 438, length 64
& H- l3 B7 I& J2 OIP (tos 0x0, ttl 64, id 18696, offset 0, flags [DF], proto ICMP (1), length 84)
; t0 Q3 A$ y' [. ]4 ]# k) G    10.4.5.100 > CD--6: ICMP echo reply, id 7024, seq 438, length 64
6 G/ |" L. L. ?: qIP (tos 0x0, ttl 64, id 18958, offset 0, flags [DF], proto ICMP (1), length 84)
    CD--6 > 10.4.5.100: ICMP echo request, id 7024, seq 439, length 64
  K7 ^3 n2 d5 e4 c9 d% DIP (tos 0x0, ttl 64, id 18958, offset 0, flags [DF], proto ICMP (1), length 84)
3 ^# y. A3 Q# Z    10.4.5.100 > CD--6: ICMP echo reply, id 7024, seq 439, length 64
* L7 e. C8 h! M5 \& G  I5 MIP (tos 0x0, ttl 64, id 19338, offset 0, flags [DF], proto ICMP (1), length 84)
1 S  i2 r8 c7 c* z: [4 C% q0 j    CD--6 > 10.64.35.100: ICMP echo request, id 7024, seq 440, length 64
IP (tos 0x0, ttl 64, id 19338, offset 0, flags [DF], proto ICMP (1), length 84)
    10.4.5.100 > CD--6: ICMP echo reply, id 7024, seq 440, length 64

1320503165

sudo  tcpdump -i vnet7 -vv -e icmp   抓取vnet7子接口地址

admin

sudo tcpdump -i bond1 -vv icmp  
; b% O1 e! s4 Y5 X; dtcpdump: WARNING: bond1: no IPv4 address assigned
tcpdump: listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
16:16:57.141135 IP (tos 0x0, ttl 62, id 52282, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1157, length 64
8 S/ Z: _  \! ?0 ?/ y16:16:58.141200 IP (tos 0x0, ttl 62, id 52414, offset 0, flags [DF], proto ICMP (1), length 84)
$ ~5 T1 H: P: `5 J7 t    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1158, length 64
3 T0 h. B) k( f$ @16:16:59.141214 IP (tos 0x0, ttl 62, id 53243, offset 0, flags [DF], proto ICMP (1), length 84)
5 ]" K% }" p1 o7 ]# ?    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1159, length 64
16:17:00.141085 IP (tos 0x0, ttl 62, id 53622, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1160, length 64

admin

sudo tcpdump -i bond1 -vv -e icmp  
tcpdump: WARNING: bond1: no IPv4 address assigned
tcpdump: listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
, }3 b' r7 B+ Z( h! s16:21:23.140673 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 47732, offset 0, flags [DF], proto ICMP (1), length 84)

1 ?. k. l+ k+ h  k' g

  y' U) L0 S; h9 O4 \& T: X! L1 u8 ?    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1423, length 64
! ~, Z6 X4 d7 c& a) w* b. u8 X! ]- \  N16:21:24.140663 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 47779, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1424, length 64
16:21:25.140651 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 48122, offset 0, flags [DF], proto ICMP (1), length 84)
8 O' G, ?5 b% ~7 ~' L4 @    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1425, length 64
+ t. @$ c! P& s! i8 c9 P# d: W16:21:26.140629 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 48938, offset 0, flags [DF], proto ICMP (1), length 84)
9 g+ v* s4 F4 M" l: G    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1426, length 64
16:21:27.140613 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 49679, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1427, length 64
16:21:28.140616 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 50377, offset 0, flags [DF], proto ICMP (1), length 84)
3 w% M2 {0 q" U7 e: X6 _    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1428, length 64
+ W0 N- [0 g3 C16:21:29.140633 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 50603, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1429, length 64
- f, ?" A/ X% ^! @6 L- ]2 Q; j! J16:21:30.140614 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 51285, offset 0, flags [DF], proto ICMP (1), length 84)

admin

sudo tcpdump -i bond1 -vvv -e icmp  
tcpdump: WARNING: bond1: no IPv4 address assigned
9 j" q$ l  f7 _1 H/ d1 Ttcpdump: listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
6 c4 V# g! \. `* K3 o. U/ S, e% c+ k16:22:01.140593 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 1576, offset 0, flags [DF], proto ICMP (1), length 84)
5 o) _. ^& L+ P% }( Q% b    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1461, length 64
# R! c( M# }( X% N  K8 ?/ ?16:22:02.140601 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 1841, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1462, length 64
. u5 e) ~+ e. z4 M; w+ [2 Z16:22:03.140606 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 2688, offset 0, flags [DF], proto ICMP (1), length 84)
; e6 i& R4 Q$ Z1 w% l1 W    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1463, length 64
0 b* u7 S3 X  h1 @1 J5 I16:22:04.140584 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 3273, offset 0, flags [DF], proto ICMP (1), length 84)
    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1464, length 64
+ j! v5 b7 r6 @% W6 E$ f: I16:22:05.140544 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 3297, offset 0, flags [DF], proto ICMP (1), length 84)
& Y9 u: `. |7 W$ _" e    10.32.69.236 > 43.240.248.70: ICMP echo request, id 16362, seq 1465, length 64
3 w! P1 |- @; y# c" @. j; \16:22:06.140605 00:0e:1e:b3:98:20 (oui Unknown) > 00:00:5e:00:01:65 (oui Unknown), ethertype 802.1Q (0x8100), length 102: vlan 205, p 0, ethertype IPv4, (tos 0x0, ttl 62, id 3547, offset 0, flags [DF], proto ICMP (1), length 84)

admin

sudo tcpdump  -i  tapa72cc152-ce -w 43.240.248.70.cap