Tcpdump

列出能抓取的網口和usb口

> tcpdump -D

如果想要抓 eth0 的包

> tcpdump -i eth0 -w xxx.cap

抓 eth0 上來自於192.168.1.98 的包

> tcpdump -i eth0 host 192.168.1.98 -w xxx.cap

抓192.168.1.123的80埠的包

> tcpdump -i eth0 host 192.168.1.98 and port 80 -w xxx.cap 

抓192.168.1.123的icmp的包

> tcpdump -i eth0 host 192.168.1.98 and icmp -w xxx.cap 

抓192.168.1.98的80埠和110和25以外的其他埠的包

> tcpdump -i eth0 host 192.168.1.98 and ! port 80 and ! port 25 and ! port 110 -w /tmp/xxx.cap