TCPDUMP抓取任意ANY接口数据包

TCPDUMP在使用如下命令,抓取任意接口数据包(比如icmp)时,将重新数据包的目的MAC地址,致使抓取到的数据包非真实流量中的目的MAC地址。如果指定接口名称(使用 -i eth0),就不存在此问题。

tcpdump -i any -envv icmp

抓取到的数据包如下:

# tcpdump -i any -envv icmp
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
In 50:7b:9d:c7:03:73 ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 6582, offset 0, flags [none], proto ICMP (1), length 60)
    192.168.1.110 > 192.168.1.104: ICMP echo request, id 1, seq 64, length 40
Out 00:0c:29:74:7f:04 ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 27949, offset 0, flags [none], proto ICMP (1), length 60)
    192.168.1.104 > 192.168.1.110: ICMP echo reply, id 1, seq 64, length 40

尽管使用了-e选项要求显示以太网头部信息,tcpdump仅显示了数据包的源MAC地址字段和以太网类型字段。将数据报文保存下来,使用wireshark查看,进行如下抓包操作:

# tcpdump -i any -envv icmp -s0 -w icmp-any.pcap

如下如所示,wireshark解释了数据包中的目的MAC地址信息。这里tcpdump伪造了一个16字节的链路头部(Linux cooked capture),包括6个字段,分别为Packet type(2B)、Link-layer address type(2B)、Link-layer address length(2B)、Source MAC(6B)、未使用unused字段(2B)和两个字节的协议Protocol字段。

ICMP Echo回复报文如下:

有关Linux cooked capture的详细解释见tcpdump官方网站:http://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL.html。
Packet type字段:
    0, if the packet was specifically sent to us by somebody else;
    1, if the packet was broadcast by somebody else;
    2, if the packet was multicast, but not broadcast, by somebody else;
    3, if the packet was sent to somebody else by somebody else;
    4, if the packet was sent by us.

Link-layer address type字段:
    定义见内核文件include/uapi/linux/if_arp.h,抓包显示的数字1为ARPHRD_ETHER。

 

END

已标记关键词 清除标记
©️2020 CSDN 皮肤主题: 编程工作室 设计师:CSDN官方博客 返回首页