1. 介绍
tcpdump是一款用来截取网络数据的工具
这里主要介绍的是为嵌入式Linux编译tcpdump的方法
2. 编译
首先去官网下载源代码, 需要下载tcpdump和libpcap, 将他们解压到同一个目录下~/tcpdump/papage/
2.1 编译libpcap
进入libpcap源码所在目录, 执行如下命令
./configure --prefix=~/tcpdump/tools --host=arm-linux --target=arm-linux CC=arm-linux-xxx-gcc --with-pcap=linuxmake; make install
.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }
编译成功后会在~/tcpdump/tools目录下生成三个个文件夹bin, include和lib
里面包含了libpcap的头文件, 库及配置信息
2.2 编译tcpdump
进入tcpdump源码所在目录, 执行如下命令
./configure --prefix=~/tcpdump/tools --host=arm-linux --target=arm-linux CC=arm-linux-xxx-gcc ac_cv_linux_vers=2make; make install
编译完成后会在~/tcpdump/tools/sbin目录下找到独立的可执行文件tcpdump
这里需要说明的是CC参数指定了交叉编译器, 编译两者时需要指定相同的目录, 否则在编译tcpdump时需要指定libpcap的路径
3. tcpdump命令
tcpdump有如下常用命令
tcpdump -D: 显示所有支持截取的设备tcpdump -i eth0 -w capture.pcap: 截取eth0接口的数据并保存至capture.pcap(可用wireshark查看)
.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }
4. tcpdump截取usb数据
除了网络数据包, tcpdump还可以截取usb数据
前提是系统中支持usbmon, 参考<CentOS 7下Wireshark捕获USB数据包>
通过如下命令安装usbmon模块
modprobe usbmon(如果已经编译进内核该步骤则不需要)mount -t debugfs none /sys/kernel/debugls /sys/kernel/debug/usb/usbmon./tcpdump -i usbmon1 -w usb.pcap
.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }
参考:
<man tcpdump>