tcpdump 抓包记录

news2024/9/25 23:21:38

在这里插入图片描述

查看发往 10.0.2.220 的包

[root@bigdata-storage-05 ~]# tcpdump -i any -nn dst 10.0.2.220
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
16:40:55.025319 IP 10.0.2.73.59494 > 10.0.2.220.9095: Flags [P.], seq 3962697123:3962697192, ack 1011277450, win 30074, options [nop,nop,TS val 4050172448 ecr 3356064818], length 69
16:40:55.025347 IP 10.0.2.73.49498 > 10.0.2.220.9093: Flags [P.], seq 152494368:152494437, ack 3546093952, win 30408, options [nop,nop,TS val 4050172448 ecr 3356064818], length 69
...
16:40:55.229310 IP 10.0.2.73.49650 > 10.0.2.220.9093: Flags [.], ack 607, win 30408, options [nop,nop,TS val 4050172652 ecr 3356065121], length 0
16:40:55.229354 IP 10.0.2.73.47534 > 10.0.2.220.9094: Flags [.], ack 607, win 30076, options [nop,nop,TS val 4050172652 ecr 3356065121], length 0
^C
64 packets captured
67 packets received by filter
0 packets dropped by kernel

在这里插入图片描述

k8s 容器抓包

[root@k8s-compute-03 ~]# docker exec -it c947dcc2e73e  bash
root@flink-taskmanager-0:/opt/flink# exit
exit
[root@k8s-compute-03 ~]# docker inspect --format "{{.State.Pid}}"  c947dcc2e73e
95023

[root@k8s-compute-03 ~]# nsenter -n -t 95023 tcpdump -i any -nn dst 10.0.2.66
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
17:42:34.567767 IP 10.244.12.213.33548 > 10.0.2.66.9092: Flags [.], ack 3844607508, win 32069, options [nop,nop,TS val 1923034209 ecr 4105977359], length 0
17:42:34.567825 IP 10.244.12.213.33548 > 10.0.2.66.9092: Flags [P.], seq 0:116, ack 1, win 32069, options [nop,nop,TS val 1923034209 ecr 4105977359], length 116
...
17:42:34.927819 IP 10.244.12.213.33548 > 10.0.2.66.9092: Flags [P.], seq 1624:1740, ack 7715, win 32069, options [nop,nop,TS val 1923034569 ecr 4105977719], length 116
^C
66 packets captured
74 packets received by filter
0 packets dropped by kernel