Android-TCPDump for Android（抓TCP数据包工具）

下载tcpdump，还有个地址是http://www.strazzere.com/android/tcpdump，不知道具体版本。
详细使用请参考http://www.tcpdump.org/里面的文档
你需要root权限，
adb push c:wherever_you_puttcpdump /data/local/tcpdump
adb shell chmod 6755 /data/local/tcpdump

抓包很简单

adb shell tcpdump -p -vv -s 0 -w /sdcard/capture.pcap
# "-p": disable promiscuous mode (doesn't work anyway)
# "-s 0": capture the entire packet
# "-w": write packets to a file (rather than printing to stdout)
... do whatever you want to capture, then ^C to stop it ...

导出

adb pull /sdcard/capture.pcap .

下载wireshark查看数据包，地址是http://www.wireshark.org/download.html，打开这个数据包，就可以查看数据包内容了。

adb shell tcpdump -p -vv -s 0 -w /sdcard/capture.pcap

tcpdump 的抓包保存到文件的命令参数是-w xxx.cap

抓eth1的包
tcpdump -i eth1 -w /tmp/xxx.cap

抓 192.168.1.123的包
tcpdump -i eth1 host 192.168.1.123 -w /tmp/xxx.cap

抓192.168.1.123的80端口的包
tcpdump -i eth1 host 192.168.1.123 and port 80 -w /tmp/xxx.cap

抓192.168.1.123的icmp的包
tcpdump -i eth1 host 192.168.1.123 and icmp -w /tmp/xxx.cap

抓192.168.1.123的80端口和110和25以外的其他端口的包
tcpdump -i eth1 host 192.168.1.123 and ! port 80 and ! port 25 and ! port 110 -w /tmp/xxx.cap

抓vlan 1的包
tcpdump -i eth1 port 80 and vlan 1 -w /tmp/xxx.cap

抓pppoe的密码
tcpdump -i eth1 pppoes -w /tmp/xxx.cap

以100m大小分割保存文件，超过100m另开一个文件 -C 100m

抓10000个包后退出 -c 10000

后台抓包，控制台退出也不会影响：
nohup tcpdump -i eth1 port 110 -w /tmp/xxx.cap &

更多相关文章

随机推荐