1.wireshark安装
yum install wireshark
2.使用tshark抓包命令
抓包命令tshark --help,这个会有屏幕上显示,因为我用的是最小化系统安装,故用tshark命令
tshark -i eth0
3.指定输出路径
如果要保存加-w 文件名.pcap也可以指定路径,如果不指定默认保存在当前目录下
tshark --help得到如下提示:
-w <outfile|-> write packets to a pcap-format file named "outfile"
(or to the standard output for "-")
-W n Save extra information in the file, if supported.
n = write network address resolution information
例子:
[root@VM3 data]# tshark -w t1.pcap -i eth0
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
36 C
达到你要的包数按ctrl+c退出即可
[root@VM3 data]# tshark -w t1.pcap -W n -i eth0
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
48 C
达到你要的包数按ctrl+c退出即可
4.下载数据
最后用sz命令把抓到的包下载下来,用windows的Wireshark打开即可