ifconfig ( network interfaces configuring )

• eth0表示网卡
• UP代表网卡开启状态
• RUNNING代表网卡的网线被接上
• mtu1500: MTU（最大传输单元）是指在网络中传输数据时，单个数据包的最大长度。MTU的值越大，单个数据包的最大长度就越大，网络传输效率就越高。
• MULTICAST表示支持组播。
• ether 14:7d:da:df:43:24，mac物理地址
• inet（IP地址）：192.168.2.108。netmask（掩码地址）：0xffffff00。broadcast（广播地址）：192.168.2.255。
• media: autoselect—— 网络媒介类型
• status: active—— 激活状态

tcpdump 命令

NAME
       tcpdump - dump traffic on a network

SYNOPSIS
       tcpdump [ -AbdDefhHIJKlLnNOpqStuUvxX# ] [ -B buffer_size ]
               [ -c count ]
               [ -C file_size ] [ -G rotate_seconds ] [ -F file ]
               [ -i interface ] [ -j tstamp_type ] [ -k (metadata_arg) ]
               [ -m module ] [ -M secret ]
               [ --number ] [ -Q in|out|inout ]
               [ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
               [ -W filecount ]
               [ -E spi@ipaddr algo:secret,...  ]
               [ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
               [ -Q packet-metadata-filter ] [ -Q in|out|inout ]
               [ --time-stamp-precision=tstamp_precision ]
               [ --immediate-mode ] [ --version ]
               [ expression ]

DESCRIPTION
       Tcpdump  prints  out  a  description  of the contents of packets on a network interface that match the boolean
       expression; the description is preceded by a time stamp, printed, by default, as hours, minutes, seconds,  and
       fractions of a second since midnight.  It can also be run with the -w flag, which causes it to save the packet
       data to a file for later analysis, and/or with the -r flag, which causes it to read from a saved  packet  file
       rather than to read packets from a network interface.  It can also be run with the -V flag, which causes it to
       read a list of saved packet files. In all cases, only packets that match expression will be processed by  tcp-
       dump.

       Tcpdump will, if not run with the -c flag, continue capturing packets until it is interrupted by a SIGINT sig-
       nal (generated, for example, by typing your interrupt character, typically  control-C)  or  a  SIGTERM  signal
       (typically  generated  with the kill(1) command); if run with the -c flag, it will capture packets until it is
       interrupted by a SIGINT or SIGTERM signal or the specified number of packets have been processed.

常用：

-nn，直接以 IP 及 Port Number 显示，而非主机名与服务名称。

-i，后面接要「监听」的网络接口，例如 eth0, lo, ppp0 等等的接口。

-w，如果你要将监听所得的数据包数据储存下来，用这个参数就对了。后面接文件名。

-c，监听的数据包数，如果没有这个参数， tcpdump 会持续不断的监听，

 直到用户输入 [ctrl]-c 为止。

-A，数据包的内容以 ASCII 显示，通常用来捉取 WWW 的网页数据包资料。

-e，使用资料连接层 (OSI 第二层) 的 MAC 数据包数据来显示。

-q，仅列出较为简短的数据包信息，每一行的内容比较精简。

-X，可以列出十六进制 (hex) 以及 ASCII 的数据包内容，对于监听数据包内容很有用。

-r，从后面接的文件将数据包数据读出来。那个「文件」是已经存在的文件，并且这个「文件」是由 -w 所制作出来的。所欲捕获的数据内容：我们可以专门针对某些通信协议或者是 IP 来源进行数据包捕获。

vv : 输出详细的报文信息

tcpdump&wireshark例子

% nslookup baidu.com
Server:		192.168.1.1
Address:	192.168.1.1#53

Non-authoritative answer:
Name:	baidu.com
Address: 39.156.66.10
Name:	baidu.com
Address: 110.242.68.66

tcp抓包

% sudo tcpdump -i en0  -nnvv -w tmp.cap 
tcpdump: listening on en0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C2415 packets captured
2415 packets received by filter
0 packets dropped by kernel

https访问百度了：

wireshark查看