{"id":1777,"date":"2024-12-03T11:33:55","date_gmt":"2024-12-03T03:33:55","guid":{"rendered":"http:\/\/blue.yn.cn\/?p=1777"},"modified":"2024-12-04T21:07:10","modified_gmt":"2024-12-04T13:07:10","slug":"protocol%e5%91%bd%e4%bb%a4","status":"publish","type":"post","link":"http:\/\/blue.yn.cn\/?p=1777","title":{"rendered":"tcpdump\u547d\u4ee4"},"content":{"rendered":"<h3>\u5b89\u88c5protocol\u547d\u4ee4<\/h3>\n<p>\u7f51\u7edc\u534f\u8bae\u7684\u5934\u90e8\u5c01\u88c5\u7684\u5b57\u6bb5\u5f88\u96be\u8bb0\u4f4f\uff0c\u9700\u8981\u67e5\u8d44\u6599\uff0c\u8fd9\u91cc\u4ecb\u7ecd\u4e00\u79cd\u5728<code>linux<\/code>\u6267\u884c<code>protocol<\/code>\u547d\u4ee4\u6765\u5c55\u793a\u534f\u8bae\u7684\u5934\u90e8\u5c01\u88c5\u4fe1\u606f\u3002<\/p>\n<ol>\n<li>\n<p>\u5728<code>zabbixserver<\/code>\u865a\u673a\u4e0b\u8f7d\uff1a<code>git clone https:\/\/github.com\/luismartingarcia\/protocol.git<\/code><\/p>\n<\/li>\n<li>\n<p>\u8fdb\u5165<code>\/root\/protocol<\/code>\u5b89\u88c5\uff1a<code>.\/setup.py install<\/code><\/p>\n<\/li>\n<li>\n<p>\u6267\u884c\u547d\u4ee4\uff1a<code>protocol ip<\/code><\/p>\n<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/12\/image-1733209296126.png\" alt=\"file\" \/><\/p>\n<ol start=\"4\">\n<li><a href=\"https:\/\/www.luismg.com\/protocol\/\" title=\"\u4f7f\u7528\u65b9\u6cd5\">\u4f7f\u7528\u65b9\u6cd5<\/a><\/li>\n<\/ol>\n<h3>tcpdump\u7ec3\u4e60<\/h3>\n<h4>\u662f\u5426\u8bbe\u7f6e\u4e86IP\u9009\u9879<\/h4>\n<p>\u6211\u4eec\u77e5\u9053\u6b63\u5e38\u7684<code>ipv4<\/code>\u62a5\u5934\u7684\u957f\u5ea6\u901a\u5e38\u4e3a20\u5b57\u8282\uff0c\u5982\u679c\u8bbe\u7f6e\u6709<code>option<\/code>\u5b57\u6bb5\uff0c\u62a5\u5934\u4f1a\u66f4\u957f\u3002<br \/>\n<code>ipv4<\/code>\u62a5\u5934\u5177\u6709\u62a5\u5934\u957f\u5ea6\u5b57\u6bb5\uff0c\u6211\u4eec\u5c06\u5728\u6b64\u5904\u5bf9\u5176\u8fdb\u884c\u7b5b\u9009\uff0c\u4ee5\u4e86\u89e3\u62a5\u5934\u957f\u5ea6\u662f\u5426\u8d85\u8fc7\u4e8620\u5b57\u8282\u3002<\/p>\n<p>+-+-+-+-+-+-+-+-+<br \/>\n|Version|  IHL  |<br \/>\n+-+-+-+-+-+-+-+-+<\/p>\n<p>\u901a\u5e38\uff0c\u7b2c\u4e00\u4e2a\u5b57\u8282\u7684\u4e8c\u8fdb\u5236\u503c\u4e3a0100 0101<\/p>\n<pre><code class=\"language-bash\">0100 = 4 in decimal. This is the IP version.\n0101 = 5 in decimal. This is the number of blocks of 32 bits in the headers. 5 x 32 bits = 160 bits or 20 bytes.<\/code><\/pre>\n<p>\u5982\u679c\u62a5\u5934\u8bbe\u7f6e\u4e86<code>ip<\/code>\u9009\u9879\uff0c\u5219\u7b2c\u4e00\u4e2a\u5b57\u8282\u7684\u540e\u534a\u90e8\u5206\u5c06\u5927\u4e8e5.<\/p>\n<p>\u6211\u4eec\u6709\u4e24\u79cd\u65b9\u6cd5\u53ef\u4ee5\u5904\u7406\u8fd9\u79cd\u7b5b\u9009\/\u8fc7\u6ee4<\/p>\n<ul>\n<li>\u5c1d\u8bd5\u5339\u914d\u5927\u4e8e01000101\u7684\u503c\u3002\u8fd9\u5c06\u5339\u914d\u8bbe\u7f6e\u4e86<code>ip<\/code>\u9009\u9879\u7684<code>ipv4<\/code>\u6d41\u91cf\uff0c\u4f46\u4e5f\u4f1a\u5339\u914d\u4efb\u4f55<code>ipv6<\/code>\u7684\u6d41\u91cf\u3002<\/li>\n<\/ul>\n<p>01000101\u5341\u8fdb\u5236\u7684\u503c=64 + 4 + 1 = 69<\/p>\n<p>\u8fc7\u6ee4\u89c4\u5219\u914d\u7f6e\u4e3a\uff1a<code>tcpdump &#039;ip[0] &gt; 69&#039;<\/code><\/p>\n<ul>\n<li>\u6b63\u786e\u7684\u65b9\u6cd5\uff1a<strong>\u63a9\u76d6<\/strong>\u7b2c1\u4e2a\u5b57\u8282\u7684\u524d4\u4f4d\uff08<code>version<\/code>\uff09\n<pre><code class=\"language-bash\">0100 0101 : 1st byte originally\n0000 1111 : mask (0xf in hex or 15 in decimal). 0 will mask the values while 1 will keep the values intact.\n---------\n0000 0101 : final result<\/code><\/pre>\n<p>\u6240\u4ee5\u6b63\u786e\u7684\u8fc7\u6ee4\u5e94\u8be5\u4e3a\uff1a<code>tcpdump &#039;ip[0] &amp; 15 &gt; 5&#039;<\/code>\uff08\u5341\u8fdb\u5236\uff09<br \/>\n<code>tcpdump &#039;ip[0] &amp; 0xf &gt; 5&#039;<\/code>\uff08\u5341\u516d\u8fdb\u5236\uff09<\/p>\n<ul>\n<li>keep the last 4 bits intact, use (binary 00001111)0xf<\/li>\n<li>keep the first 4 bits intact, use (binary 11110000)0xf0<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4>\u662f\u5426\u8bbe\u7f6e\u4e86DF\u4f4d\uff08\u4e0d\u5206\u6bb5\uff09<\/h4>\n<p>\u73b0\u5728\u8ba9\u6211\u4eec\u5c1d\u8bd5\u600e\u6837\u77e5\u9053<code>ip<\/code>\u62a5\u6587\u662f\u5426\u53d1\u751f\u4e86\u5206\u7247\u3002\u5206\u7247\u662f\u4e0d\u53ef\u53d6\u7684\u3002\u5f53\u53d1\u9001\u65b9\u7684<code>mtu<\/code>\u5927\u4e8e\u76ee\u6807\u8def\u5f84\u4e0a\u7684\u8def\u5f84<code>mtu<\/code>\u65f6\uff0c\u5c31\u4f1a\u53d1\u751f\u5206\u7247\u3002<br \/>\n\u5206\u7247\u4fe1\u606f\u53ef\u4ee5\u5728<code>ip<\/code>\u62a5\u5934\u7684\u7b2c7\u548c\u7b2c8\u4e2a\u5b57\u8282\u4e2d\u627e\u5230\u3002<\/p>\n<pre><code class=\"language-bash\">+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n|Flags|      Fragment Offset    |\n+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\nBit 0:     reserved, must be zero\nBit 1:     (DF) 0 = May Fragment, 1 = Don&#039;t Fragment.\nBit 2:     (MF) 0 = Last Fragment, 1 = More Fragments.<\/code><\/pre>\n<p><code>fragment offset<\/code> \u5b57\u6bb5\u4ec5\u5728\u53d1\u751f\u5206\u7247\u65f6\u4f7f\u7528\u3002<\/p>\n<ul>\n<li>\n<p>\u5982\u679c\u6211\u4eec\u60f3\u5339\u914d<code>DF<\/code>\u4f4d\u4e3a1\uff08\u5373\u4e0d\u8fdb\u884c\u5206\u7247\uff09\uff1a<code>tcpdump &#039;ip[6] = 64&#039;<\/code><\/p>\n<\/li>\n<li>\n<p>\u5339\u914d\u5206\u7247<code>MF<\/code>\uff08\u66f4\u591a\u5206\u7247\u4f4d\uff09\uff0c\u8fd9\u5c06\u5339\u914d\u5206\u7247\u6570\u636e\u62a5\u6587\uff0c\u4f46\u4e0d\u5339\u914d\u6700\u540e\u4e00\u4e2a\u5206\u7247\u3002<br \/>\n<code>tcpdump &#039;ip[6] = 32&#039;<\/code><br \/>\n<code>tcpdump &#039;ip[6] &amp; 0xE0 =32&#039;<\/code><\/p>\n<\/li>\n<li>\n<p>\u6700\u540e\u4e00\u4e2a\u5206\u7247\u7684\u524d3\u4f4d\u8bbe\u7f6e\u4e3a0\u3002\u4f46\u5728<code>fragment offset<\/code>\u5b57\u6bb5\u4e2d\u6709\u6570\u636e\u3002<br \/>\n<code>tcpdump &#039;((ip[6:2] &gt; 0) and (not ip[6] = 64))&#039;<\/code><br \/>\n\u7b2c7\u4e2a\u5b57\u8282\u524d3\u4f4d\u4e3a000\uff0c\u5373\u662f\u5206\u7247\u62a5\u6587\u7684\u6700\u540e\u4e00\u4e2a\u62a5\u6587<br \/>\n\u7b2c7\u4e2a\u5b57\u8282\u524d3\u4e3a\u4e3a001\uff0c\u5373\u662f\u4e0d\u662f\u6700\u540e\u4e00\u4e2a\u62a5\u6587\u7684\u5206\u7247\u62a5\u6587<br \/>\n<code>tcpdump &#039;(ip[6] &amp; 0xE0 =0) or (ip[6] &amp; 0xE0 =32)&#039;<\/code><\/p>\n<\/li>\n<\/ul>\n<p>\u5982\u679c\u8981\u6d4b\u8bd5\u5206\u7247\uff0c\u53ef\u4ee5\u7528<code>-s<\/code>\uff1a<code>ping -s 3000 192.168.1.1<\/code><\/p>\n<h4>\u5339\u914d\u5177\u6709\u4f4eTTL\u7684\u6570\u636e\u62a5\u6587<\/h4>\n<p><code>TTL<\/code>\u5b57\u6bb5\u4f4d\u4e8e\u7b2c9\u4e2a\u5b57\u8282\u4e2d\uff0c\u53601\u5b57\u8282\uff0c\u56e0\u6b64<code>TTL<\/code>\u5b57\u6bb5\u7684\u6700\u5927\u503c\u4e3a255.<\/p>\n<p>\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u5728\u7f51\u5173\u4e0a\u4f7f\u7528\u4ee5\u4e0b\u7684\u547d\u4ee4\u6765\u67e5\u770b\u6211\u4eec\u7684\u7f51\u7edc\u4e0a\u662f\u5426\u6709\u4eba\u6b63\u5728\u4f7f\u7528<code>traceroute<\/code><br \/>\n<code>tcpdump &#039;ip[8] &lt; 5&#039;<\/code><br \/>\n\u9a8c\u8bc1\u53ef\u4ee5\u4f7f\u7528 <code>ping -t 3 192.168.1.200<\/code><\/p>\n<h4>\u5339\u914d\u957f\u5ea6\u8d85\u8fc7X\u5b57\u8282\u7684\u6570\u636e\u62a5\u6587<\/h4>\n<p><code>tcpdump &#039;ip[2:2] &gt; 600&#039;<\/code>\u5176\u4e2dX\u4e3a600\u5b57\u8282\u3002<\/p>\n<h4>TCP\u8fc7\u6ee4<\/h4>\n<ul>\n<li>\n<p>\u5339\u914d\u6e90\u7aef\u53e3&gt;1024\u7684<code>TCP<\/code>\u6d41\u91cf\uff1a<code>tcpdump &#039;tcp[0:2] &gt; 1024&#039;<\/code>\u6216<code>tcpdump tcp src portrange 1025-65535<\/code><\/p>\n<\/li>\n<li>\n<p>\u5c06<code>TCP<\/code>\u6d41\u91cf\u4e0e\u7279\u5b9a\u6807\u5fd7\u4f4d\u7ec4\u5408\u5339\u914d\uff0c\u6807\u5fd7\u4f4d\u5728<code>TCP<\/code>\u62a5\u5934\u7684\u7b2c14\u4e2a\u5b57\u8282\u4e2d\u5b9a\u4e49\u3002<br \/>\n+-+-+-+-+-+-+-+-+<br \/>\n|C|E|U|A|P|R|S|F|<br \/>\n|W|C|R|C|S|S|Y|I|<br \/>\n|R|E|G|K|H|T|N|N|<br \/>\n+-+-+-+-+-+-+-+-+<br \/>\n\u5982\u679c\u6211\u4eec\u53ea\u60f3\u5339\u914d\u4ec5\u8bbe\u7f6e\u4e86<code>syn<\/code>\u6807\u5fd7\u4f4d\u7684\u6570\u636e\u5305\uff0c\u5219\u7b2c14\u4e2a\u5b57\u8282\u7684\u4e8c\u8fdb\u5236\u4e3a00000010\uff0c\u7b49\u4e8e\u5341\u8fdb\u5236\u76842\uff1a<code>tcpdump &#039;tcp[13] = 2&#039;<\/code><br \/>\n\u5339\u914d<code>syn-ack<\/code>\uff0c\u4e8c\u8fdb\u5236\u4e3a00010010\uff0c\u7b49\u4e8e\u5341\u8fdb\u5236\u768418\uff1a<code>tcpdump &#039;tcp[13] = 18&#039;<\/code><br \/>\n\u5339\u914d<code>syn<\/code>\u6216<code>syn-ack<\/code>\u7684\u6570\u636e\u5305\uff1a<code>tcpdump &#039;tcp[13] &amp; 2 = 2&#039;<\/code><br \/>\n\u5339\u914d<code>psh-ack<\/code>\u6570\u636e\u5305\uff1a<code>tcpdump &#039;tcp[13] = 24<\/code><\/p>\n<\/li>\n<li>\n<p>\u5339\u914d\u4efb\u4f55\u5305\u542b<code>FIN<\/code>\u7ec4\u5408\u7684\u6570\u636e\u5305\uff1a<code>tcpdump &#039;tcp[13] &amp; 1 = 1&#039;<\/code><br \/>\n\u5339\u914d<code>RST<\/code>\u6807\u5fd7\u4f4d\uff1a<code>tcpdump &#039;tcp[13] &amp; 4 = 4&#039;<\/code><\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u5b89\u88c5protocol\u547d\u4ee4 \u7f51\u7edc\u534f\u8bae\u7684\u5934\u90e8\u5c01\u88c5\u7684\u5b57\u6bb5\u5f88\u96be\u8bb0\u4f4f\uff0c\u9700\u8981\u67e5\u8d44\u6599\uff0c\u8fd9\u91cc\u4ecb\u7ecd\u4e00\u79cd\u5728linux\u6267\u884cproto&#8230; &raquo; <a class=\"read-more-link\" href=\"http:\/\/blue.yn.cn\/?p=1777\">\u9605\u8bfb\u5168\u6587<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1777","post","type-post","status-publish","format-standard","hentry","category-21"],"_links":{"self":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1777"}],"version-history":[{"count":9,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1777\/revisions"}],"predecessor-version":[{"id":1787,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1777\/revisions\/1787"}],"wp:attachment":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1777"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}