What is the command to view packets in Linux?

Linux commands to view packets: 1. The tvpdump command is a very powerful network analysis tool that can capture data packets passing through the network interface and output or save them as files; 2. tshark command, It is the command line version of "Wireshark" and can be used to capture, analyze and display network data packets; 3. The ngrep command is a powerful network data packet filtering tool that can search and display network data packets based on specified expressions.

The operating environment of this article: Linux 6.4.3 system, DELL G3 computer.

In the process of using Linux systems for network troubleshooting, network security analysis, etc., it is often necessary to view the contents of network data packets. Linux provides some commands that can help us view the detailed information of the message. This article will introduce some commonly used commands and how to use them to help readers better understand and utilize these commands.

1. tcpdump command

tcpdump is a very powerful network analysis tool that can capture data packets passing through the network interface and output or save them as files. The following is the basic usage of tcpdump:

1. Command format:

tcpdump [option] [expression]

2. Common options:

- -i: Specify the monitored network interface, such as eth0 or enp0s3.

- -c: Specify the number of packets to capture.

- -w: Save the captured packets to a file.

- -r: Read packets from the file and analyze them.

- -X: Display data packets in hexadecimal and ASCII format.

- -n: Disable resolution of IP addresses and ports.

- -s: Set the capture length of the data packet.

3. Example usage:

- Monitor all packets of the specified network interface:

tcpdump -i eth0

- Monitor the data of the specified IP address Packet:

tcpdump host 192.168.0.1

- Monitor the data packet of the specified port:

tcpdump port 80

- Monitor the specified source address and destination address Data packets:

tcpdump src 192.168.0.2 and dst 192.168.0.3

- Monitor the data packets of the specified source port and destination port:

tcpdump src port 1234 and dst port 5678

- Save the captured packets to a file:

tcpdump -i eth0 -w capture.pcap

- Read packets from the file And analyze:

tcpdump -r capture.pcap

- Display the data packet in hexadecimal and ASCII format:

tcpdump -X

2. tshark command

tshark is the command line version of Wireshark, which can be used to capture, analyze and display network data packets. The following is the basic usage of tshark:

1. Command format:

tshark [options] [filter conditions]

2. Common options:

- -i: Specify the network interface to be monitored.

- -c: Specify the number of packets to be captured.

- -w: Save the captured data packets to a file.

- -r: Read packets from the file and analyze them.

- -V: Display detailed information for each packet in a verbose manner.

- -T: Specify the output format as text, json, pdml, etc.

- -Y: Set filter conditions.

3. Example usage:

- Monitor all packets of the specified network interface:

tshark -i eth0

- Monitor the data of the specified IP address Packet:

tshark host 192.168.0.1

- Monitor the data packet of the specified port:

tshark port 80

- Monitor the specified source address and destination address Data packets:

tshark src 192.168.0.2 and dst 192.168.0.3

- Monitor the data packets of the specified source port and destination port:

tshark src port 1234 and dst port 5678

- Save the captured packets to a file:

tshark -i eth0 -w capture.pcap

- Read packets from the file And analyze it:

tshark -r capture.pcap

- Display packets in detailed way:

tshark -V

三, ngrep command

ngrep is a powerful network packet filtering tool that can search and display network packets based on specified expressions. The following is the basic usage of ngrep:

1. Command format:

ngrep [option] Expression

2. Common options:

- -i : Ignore case.

- -q: Only display matching packets.

- -W: Set the number of bytes to capture.

- -d: Specify the network interface to monitor.

- -O: Display the offset of the packet.

- -x: Display data packets in hexadecimal.

- -A: Display subsequent data of matching packets.

3. Example usage:

- Listen for all packets on the specified network interface:

ngrep -d eth0

- Search for data on the specified IP address Packet:

ngrep host 192.168.0.1

- Search for packets on the specified port:

ngrep port 80

- Search for the specified source address and destination address Packets:

ngrep src 192.168.0.2 and dst 192.168.0.3

- Search for packets with specified source port and destination port:

ngrep src port 1234 and dst port 5678

- Set the number of bytes to capture:

ngrep -W 100

- Display the matching packets in hexadecimal:

ngrep -x

Summary:

Linux system provides some powerful commands, such as tcpdump, tshark and ngrep, which can help us view the detailed information of messages. Understanding the basic usage of these commands is very helpful for network troubleshooting, network security analysis, and network packet analysis. With in-depth use and accumulation of experience, readers can better utilize these tools to solve practical problems.

The above is the detailed content of What is the command to view packets in Linux?. For more information, please follow other related articles on the PHP Chinese website!