{"id":13823,"date":"2023-08-16T23:49:31","date_gmt":"2023-08-16T14:49:31","guid":{"rendered":"https:\/\/lab4ict.com\/system\/?p=13823"},"modified":"2023-08-17T07:12:29","modified_gmt":"2023-08-16T22:12:29","slug":"tcpdump%e3%81%a7%e3%83%91%e3%82%b1%e3%83%83%e3%83%88%e3%82%ad%e3%83%a3%e3%83%97%e3%83%81%e3%83%a3%e3%81%99%e3%82%8b%ef%bc%81%ef%bc%88%e8%a1%a8%e7%a4%ba%e5%bd%a2%e5%bc%8f%e3%81%ae%e6%8c%87%e5%ae%9a","status":"publish","type":"post","link":"https:\/\/lab4ict.com\/system\/archives\/13823","title":{"rendered":"Tcpdump\u3067\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u3059\u308b\uff01\uff08\u8868\u793a\u5f62\u5f0f\u306e\u6307\u5b9a\uff09"},"content":{"rendered":"

Tcpdump\u3067\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u3057\u307e\u3059\u3002
\n<\/p>\n

Tcpdump\u30b3\u30de\u30f3\u30c9\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\uff01<\/h2>\n

tcpdump\u30b3\u30de\u30f3\u30c9\u306f\u3001\u901a\u5e38\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u3066\u3044\u306a\u3044\u5834\u5408\u306f\u3001\u6a19\u6e96\u306e\u30ea\u30dd\u30b8\u30c8\u30ea\u304b\u3089\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n

RHEL\u306btcpdump\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\uff01<\/h3>\n

RHEL\u306e\u6a19\u6e96\u306e\u30ea\u30dd\u30b8\u30c8\u30ea\u304b\u3089tcpdump\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n

\r\n$ apt install tcpdump -y\r\n<\/pre>\n
Ubuntu\u306btcpdump\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\uff01<\/h3>\n
Ubuntu\u306e\u6a19\u6e96\u306e\u30ea\u30dd\u30b8\u30c8\u30ea\u304b\u3089tcpdump\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n
\r\n$ sudo dnf install tcpdump -y\r\n<\/pre>\n
\u30aa\u30d7\u30b7\u30e7\u30f3\u7121\u3057\u3067\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u3059\u308b\uff01<\/h2>\n
\u30aa\u30d7\u30b7\u30e7\u30f3\u7121\u3057\u3067\u5b9f\u884c\u3059\u308b\u3068\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u304c\u958b\u59cb\u3055\u308c\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3\r\ndropped privs to tcpdump\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:34:52.240086 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 3300802189:3300802409, ack 3425287912, win 341, options [nop,nop,TS val 3589715395 ecr 864891819], length 220\r\n23:34:52.240288 IP dpc001p1.loc.lab4ict.com.42458 > vmsrhe11.loc.lab4ict.com.ssh: Flags [.], ack 220, win 12379, options [nop,nop,TS val 864891842 ecr 3589715395], length 0\r\n23:34:52.240798 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 220:640, ack 1, win 34\r\n...\r\n<\/pre>\n
\u30d1\u30b1\u30c3\u30c8\u6570\u3092\u6307\u5b9a\u3057\u3066\u30ad\u30e3\u30d7\u30c1\u30e3\u3059\u308b\uff01<\/h2>\n
\u300c-c\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3067\u30ad\u30e3\u30d7\u30c1\u30e3\u3059\u308b\u30d1\u30b1\u30c3\u30c8\u6570\u3092\u6307\u5b9a\u3067\u304d\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3\r\ndropped privs to tcpdump\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:37:11.857975 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 3300803665:3300803885, ack 3425288668, win 341, options [nop,nop,TS val 3589855013 ecr 865031439], length 220\r\n23:37:11.858197 IP dpc001p1.loc.lab4ict.com.42458 > vmsrhe11.loc.lab4ict.com.ssh: Flags [.], ack 220, win 12379, options [nop,nop,TS val 865031464 ecr 3589855013], length 0\r\n23:37:11.858888 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 220:640, ack 1, win 341, options [nop,nop,TS val 3589855014 ecr 865031464], length 420\r\n3 packets captured\r\n4 packets received by filter\r\n0 packets dropped by kernel\r\n<\/pre>\n
\u30d1\u30b1\u30c3\u30c8\u306e\u5185\u5bb9\u3092ASCII\u8868\u793a\u3057\u307e\u3059\uff01<\/h2>\n
\u300c-A\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u30d1\u30b1\u30c3\u30c8\u306e\u5185\u5bb9\u304cASCII\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3 -A\r\ndropped privs to tcpdump\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:38:34.058142 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 3300805169:3300805389, ack 3425289300, win 341, options [nop,nop,TS val 3589937213 ecr 865113641], length 220\r\nEH....@.@.M.\r\n...\r\n.........J1.).T...U"......\r\n...=3..).8FB.3.]~C.....|~........V..5....|%..Sc......:M....yya.YO..j..:q...3j#7....J.b...<..3..iU.B{.{s ....d9+[.%$~#..0.2...A......XHR....)..]....c}5..m|....T_.l...q.\\..A<zu...x.Q..',7.z......N.]..l)*...Gb..;......|..S]2.."..|>\r\n23:38:34.058302 IP dpc001p1.loc.lab4ict.com.42458 > vmsrhe11.loc.lab4ict.com.ssh: Flags [.], ack 220, win 12379, options [nop,nop,TS val 865113666 ecr 3589937213], length 0\r\nE..4j.@.@...\r\n...\r\n........).T..K...0['......\r\n3..B...=\r\n23:38:34.058896 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 220:976, ack 1, win 341, options [nop,nop,TS val 3589937214 ecr 865113666], length 756\r\nEH.(..@.@.K.\r\n...\r\n.........K..).T...U$(.....\r\n...>3..BW....h..N......:.....!y..1.h...... .1.~@..S...h0.....i..:G._......H.........m.q..]J....J.L.+.....D. ..}........w.0.."...B..........I.....S.r$......&..0..1..........^......%...g.1V...V....F...!..Nk%..X.h_\/$.......6A....D)...7]s_:p...U..,....8F.....................rwGPR.<#...(.U..Yq.8...r.\r\n.....w......tr"...k~;.tC..I|..:.....E..].I^..}.....$.l....v7."D.x.b.....>>d.D.D..v.V.....0.d...\\......O.G...u..5...K. ~ni......j...V..r..C.[...._..:..n.4...bF.W.$.....i...)h.A...($......{.^..I..JJp........L!C....jpT0Rq...2...tRVYa.XX...Y>u0"....o....l......I..EX1\\...yK.+.A..\\z..f"..%<.zz..U....S.p<.Q.....\r\n.(>.s;;......V..y..=..4q...!.(i.n.... *R.....CW\td..\r\n.x....E..S..9...*......6..`M...... :u.....o.~.."\\...5a#1......i...C5..UIK...[.Z..!m2....m,....-KZ..u==..S6(k\r\n3 packets captured\r\n4 packets received by filter\r\n0 packets dropped by kernel\r\n<\/pre>\n
\u30d1\u30b1\u30c3\u30c8\u306e\u5185\u5bb9\u3092HEX\u8868\u793a\u3059\u308b\uff01<\/h2>\n
\u300c-x\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u30d1\u30b1\u30c3\u30c8\u306e\u5185\u5bb9\u304cHEX\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3 -x\r\ndropped privs to tcpdump\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:40:14.700071 IP vmsrhe11.loc.lab4ict.com.ssh > dpc001p1.loc.lab4ict.com.42458: Flags [P.], seq 3300807773:3300807993, ack 3425289920, win 341, options [nop,nop,TS val 3590037855 ecr 865214282], length 220\r\n\t0x0000:  4548 0110 cab6 4000 4006 4ddc 0a01 0c0b\r\n\t0x0010:  0a01 0101 0016 a5da c4be 545d cc29 c6c0\r\n\t0x0020:  8018 0155 2210 0000 0101 080a d5fb a15f\r\n\t0x0030:  3392 1f4a 43c4 92b2 6a37 aec3 9edb c69b\r\n\t0x0040:  fcee d1ea 8b35 673c 71c2 f500 22d3 9133\r\n...\r\n<\/pre>\n
\u540d\u524d\u89e3\u6c7a\u3092\u3057\u306a\u3044\u3088\u3046\u306b\u3059\u308b\uff01<\/h2>\n
\u300c-n\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u540d\u524d\u89e3\u6c7a\u304c\u3055\u308c\u305a\u3001\u30db\u30b9\u30c8\u540d\u304c\u5fc5\u305aIP\u30a2\u30c9\u30ec\u30b9\u3067\u8868\u793a\u3055\u308c\u3044\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3 -n\r\ndropped privs to tcpdump\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:43:28.337891 IP 10.1.12.11.ssh > 10.1.1.1.42458: Flags [P.], seq 3300815385:3300815605, ack 3425291008, win 341, options [nop,nop,TS val 3590231493 ecr 865407922], length 220\r\n23:43:28.338105 IP 10.1.1.1.42458 > 10.1.12.11.ssh: Flags [.], ack 220, win 12470, options [nop,nop,TS val 865407947 ecr 3590231493], length 0\r\n23:43:28.338598 IP 10.1.12.11.ssh > 10.1.1.1.42458: Flags [P.], seq 220:584, ack 1, win 341, options [nop,nop,TS val 3590231493 ecr 865407947], length 364\r\n3 packets captured\r\n3 packets received by filter\r\n0 packets dropped by kernel\r\n<\/pre>\n
\u540d\u524d\u89e3\u6c7a\u3092\u3057\u306a\u3044\u3088\u3046\u306b\u3059\u308b\uff01<\/h2>\n
\u300c-nn\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u30dd\u30fc\u30c8\u756a\u53f7\u304c\u30b5\u30fc\u30d3\u30b9\u540d\u3067\u306f\u306a\u304f\u5fc5\u305a\u6570\u5b57\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3 -nn\r\ndropped privs to tcpdump\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:44:35.883274 IP 10.1.12.11.22 > 10.1.1.1.42458: Flags [P.], seq 3300817001:3300817221, ack 3425291568, win 341, options [nop,nop,TS val 3590299038 ecr 865475474], length 220\r\n23:44:35.883515 IP 10.1.1.1.42458 > 10.1.12.11.22: Flags [.], ack 220, win 12470, options [nop,nop,TS val 865475492 ecr 3590299038], length 0\r\n23:44:35.883961 IP 10.1.12.11.22 > 10.1.1.1.42458: Flags [P.], seq 220:576, ack 1, win 341, options [nop,nop,TS val 3590299039 ecr 865475492], length 356\r\n3 packets captured\r\n4 packets received by filter\r\n0 packets dropped by kernel\r\n<\/pre>\n
\u8a73\u7d30\u3092\u8868\u793a\u3059\u308b\uff01<\/h2>\n
\u300c-v\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u7701\u7565\u3055\u308c\u3066\u3044\u305f\u60c5\u5831\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3 -nn -v\r\ndropped privs to tcpdump\r\ntcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:47:21.740595 IP (tos 0x48, ttl 64, id 51967, offset 0, flags [DF], proto TCP (6), length 200)\r\n    10.1.12.11.22 > 10.1.1.1.42458: Flags [P.], cksum 0x21c8 (incorrect -> 0xac9f), seq 3300818581:3300818729, ack 3425292588, win 341, options [nop,nop,TS val 3590464895 ecr 865641328], length 148\r\n23:47:21.740784 IP (tos 0x10, ttl 64, id 27494, offset 0, flags [DF], proto TCP (6), length 52)\r\n    10.1.1.1.42458 > 10.1.12.11.22: Flags [.], cksum 0xcb2c (correct), ack 148, win 12470, options [nop,nop,TS val 865641347 ecr 3590464895], length 0\r\n23:47:21.741340 IP (tos 0x48, ttl 64, id 51968, offset 0, flags [DF], proto TCP (6), length 632)\r\n    10.1.12.11.22 > 10.1.1.1.42458: Flags [P.], cksum 0x2378 (incorrect -> 0x7ad5), seq 148:728, ack 1, win 341, options [nop,nop,TS val 3590464896 ecr 865641347], length 580\r\n3 packets captured\r\n4 packets received by filter\r\n0 packets dropped by kernel\r\n<\/pre>\n
\u300c-vv\u300d\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u3055\u3089\u306b\u8a73\u7d30\u306a\u60c5\u5831\u304c\u8868\u793a\u3055\u308c\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n
\r\n$ sudo tcpdump -c 3 -nn -vv\r\ndropped privs to tcpdump\r\ntcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n23:48:08.587880 IP (tos 0x48, ttl 64, id 51980, offset 0, flags [DF], proto TCP (6), length 200)\r\n    10.1.12.11.22 > 10.1.1.1.42458: Flags [P.], cksum 0x21c8 (incorrect -> 0x0c27), seq 3300820105:3300820253, ack 3425293000, win 341, options [nop,nop,TS val 3590511743 ecr 865688176], length 148\r\n23:48:08.588021 IP (tos 0x10, ttl 64, id 27516, offset 0, flags [DF], proto TCP (6), length 52)\r\n    10.1.1.1.42458 > 10.1.12.11.22: Flags [.], cksum 0x559c (correct), seq 1, ack 148, win 12470, options [nop,nop,TS val 865688194 ecr 3590511743], length 0\r\n23:48:08.588507 IP (tos 0x48, ttl 64, id 51981, offset 0, flags [DF], proto TCP (6), length 640)\r\n    10.1.12.11.22 > 10.1.1.1.42458: Flags [P.], cksum 0x2380 (incorrect -> 0xa5ab), seq 148:736, ack 1, win 341, options [nop,nop,TS val 3590511743 ecr 865688194], length 588\r\n3 packets captured\r\n4 packets received by filter\r\n0 packets dropped by kernel\r\n<\/pre>\n
\u304a\u308f\u308a\u306b<\/h2>\n
tcpdump\u3067\u306f\u3001\u69d8\u3005\u306a\u8868\u793a\u5f62\u5f0f\u304c\u6307\u5b9a\u3067\u304d\u308b\u306e\u3067\u3001\u5fc5\u8981\u306a\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u3042\u3089\u304b\u3058\u3081\u6574\u7406\u3057\u3066\u304a\u304d\u307e\u3057\u3087\u3046\u3002<\/p>\n
\u95a2\u9023\u8a18\u4e8b<\/h2>\n
\"\u3010\u8a18\u4e8b\u4e00\u89a7\u3011Linux\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3044\u3053\u306a\u3059\uff01\"<\/div>
\u3010\u8a18\u4e8b\u4e00\u89a7\u3011Linux\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3044\u3053\u306a\u3059\uff01<\/div>
Linux\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3044\u3053\u306a\u3059\u305f\u3081\u306e\u8a18\u4e8b\u4e00\u89a7\u3092\u63b2\u8f09\u3057\u307e\u3059\u3002...<\/div><\/a><\/div>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Tcpdump\u3067\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u3057\u307e\u3059\u3002<\/p>\n","protected":false},"author":1,"featured_media":5527,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[874],"tags":[915,52,408,853,917,916],"class_list":["post-13823","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network-linux","tag-tcpdump","tag-52","tag-408","tag-853","tag-917","tag-916"],"_links":{"self":[{"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/posts\/13823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/comments?post=13823"}],"version-history":[{"count":8,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/posts\/13823\/revisions"}],"predecessor-version":[{"id":13855,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/posts\/13823\/revisions\/13855"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/media\/5527"}],"wp:attachment":[{"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/media?parent=13823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/categories?post=13823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab4ict.com\/system\/wp-json\/wp\/v2\/tags?post=13823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}