1、tcpdump的参数信息
-n 不转换主机地址到主机名，这样用于避免DNS解析
-i 指定网络接口
-e 增加以太网帧头部信息输出
-v 输出更详细的信息
2、抓取vlan的信息
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
# tcpdump -ni em2 -v -e | grep vlan
tcpdump: WARNING: em2: no IPv4 address assigned
tcpdump: listening on em2, link-
type
EN10MB (Ethernet), capture size 65535 bytes
17:32:16.532355 00:e0:4c:84:5c:a3 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.26 tell 172.16.1.99, length 46
17:32:16.568647 06:4b:36:00:00:46 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
24184, offset 0, flags [none], proto VRRP (112), length 40)
17:32:16.666799 18:66:da:eb:00:10 > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 172, p 0, ethertype IPv4, (tos 0x0, ttl 128,
id
23044, offset 0, flags [none], proto UDP (17), length 78)
17:32:16.840217 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.28 tell 172.16.1.152, length 46
17:32:16.855502 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.27 tell 172.16.1.152, length 46
17:32:16.863344 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.27 tell 172.16.1.151, length 46
17:32:16.863778 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.28 tell 172.16.1.151, length 46
17:32:16.894936 06:0b:1e:00:00:7f > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
11523, offset 0, flags [none], proto VRRP (112), length 40)
17:32:16.895184 06:7a:e4:00:00:29 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
47219, offset 0, flags [none], proto VRRP (112), length 40)
17:32:17.287184 06:a6:8e:00:00:10 > 33:33:00:01:00:02, ethertype 802.1Q (0x8100), length 161: vlan 173, p 0, ethertype IPv6, (hlim 1, next-header UDP (17) payload length: 103) fe80::89e9:16fa:9921:a2de.dhcpv6-client > ff02::1:2.dhcpv6-server: [udp
sum
ok] dhcp6 solicit (xid=343686 (elapsed-
time
703) (client-ID hwaddr
/time
type
1
time
556803887 06a68e000010) (IA_NA IAID:302422322 T1:0 T2:0) (Client-FQDN) (vendor-class) (option-request DNS-search-list DNS-server vendor-specific-info Client-FQDN))
17:32:17.300035 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.26 tell 172.16.1.152, length 46
17:32:17.392404 00:e0:4c:84:5c:a3 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.27 tell 172.16.1.99, length 46
17:32:17.430664 18:66:da:eb:00:10 > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 172, p 0, ethertype IPv4, (tos 0x0, ttl 128,
id
24752, offset 0, flags [none], proto UDP (17), length 78)
17:32:17.568896 06:4b:36:00:00:46 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
24185, offset 0, flags [none], proto VRRP (112), length 40)
17:32:17.799903 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.28 tell 172.16.1.152, length 46
17:32:17.799936 00:0c:29:c5:ea:d5 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.27 tell 172.16.1.152, length 46
17:32:17.864017 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.27 tell 172.16.1.151, length 46
17:32:17.864393 00:0c:29:78:b9:5a > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.28 tell 172.16.1.151, length 46
17:32:17.896318 06:7a:e4:00:00:29 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
47220, offset 0, flags [none], proto VRRP (112), length 40)
17:32:17.896327 06:0b:1e:00:00:7f > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
11524, offset 0, flags [none], proto VRRP (112), length 40)
17:32:18.154418 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 176, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80b0.2c:31:24:34:1c:80.8009, length 42
17:32:18.154818 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 177, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80b1.2c:31:24:34:1c:80.8009, length 42
17:32:18.155353 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 178, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80b2.2c:31:24:34:1c:80.8009, length 42
17:32:18.164715 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 180, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80b4.2c:31:24:34:1c:80.8009, length 42
17:32:18.165125 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 179, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80b3.2c:31:24:34:1c:80.8009, length 42
17:32:18.195014 18:66:da:eb:00:10 > Broadcast, ethertype 802.1Q (0x8100), length 96: vlan 172, p 0, ethertype IPv4, (tos 0x0, ttl 128,
id
26667, offset 0, flags [none], proto UDP (17), length 78)
17:32:18.392359 00:e0:4c:84:5c:a3 > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.27 tell 172.16.1.99, length 46
17:32:18.411455 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.217 tell 172.16.1.254, length 50
17:32:18.411660 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.23 tell 172.16.1.254, length 50
17:32:18.411872 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.210 tell 172.16.1.254, length 50
17:32:18.412088 84:d9:31:82:74:8e > Broadcast, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request
who
-has 172.16.1.181 tell 172.16.1.254, length 50
17:32:18.473644 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 192, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80c0.2c:31:24:34:1c:80.8009, length 42
17:32:18.474051 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 253, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80fd.2c:31:24:34:1c:80.8009, length 42
17:32:18.474575 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 254, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80fe.2c:31:24:34:1c:80.8009, length 42
17:32:18.475530 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 1000, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
83e8.2c:31:24:34:1c:80.8009, length 42
17:32:18.476037 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 173, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80ad.2c:31:24:34:1c:80.8009, length 42
17:32:18.483481 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 174, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80ae.2c:31:24:34:1c:80.8009, length 42
17:32:18.485569 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 172, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80ac.2c:31:24:34:1c:80.8009, length 42
17:32:18.486260 2c:31:24:34:1c:89 > 01:00:0c:cc:cc:
cd
, ethertype 802.1Q (0x8100), length 68: vlan 175, p 0, LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid PVST (0x010b): STP 802.1d, Config, Flags [none], bridge-
id
80af.2c:31:24:34:1c:80.8009, length 42
17:32:18.569139 06:4b:36:00:00:46 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 64: vlan 173, p 0, ethertype IPv4, (tos 0xc0, ttl 255,
id
24186, offset 0, flags [none], proto VRRP (112), length 40)
17:32:18.691450 54:c4:15:51:8e:de > 01:00:5e:7f:ff:fa, ethertype 802.1Q (0x8100), length 184: vlan 254, p 0, ethertype IPv4, (tos 0x0, ttl 4,
id
0, offset 0, flags [DF], proto UDP (17), length 166)
|
说明：此命令适用于调试Linux网络时候，查看vlan相关的tag信息，存档，备忘。
本文转自 冰冻vs西瓜 51CTO博客，原文链接：http://blog.51cto.com/molewan/2062159，如需转载请自行联系原作者
