tcpdump抓包

tcpdump [opt] [not] proto dir type

opt: -nn\-vvv\-XX\-i\-c\-e

proto: tcp/udp/arp/ip/ether/icmp

dir: src、dst、src and dst、src or dst

type: host/port/net/portrange

exp:

tcpdump -i any -nn dst port 80 and src host 192.168.1.1 -s 2048 -XX -tt -w ret.cap