安裝工具

• 以 centos 為例,安裝 tcpdump 工具

yum install -y tcpdump

• 執行命令 ip addr show 檢視網絡卡名

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:6a:5f:93 brd ff:ff:ff:ff:ff:ff
    inet 192.168.119.160/24 brd 192.168.119.255 scope global noprefixroute dynamic ens33
       valid_lft 1358sec preferred_lft 1358sec
    inet6 fe80::1646:1c58:ee87:bc13/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
 

• 然後可以執行以下命令進行抓包

tcpdump tcp -i ens33 -w ./package.cap

• 接著我們可以將輸出的資料匯入到 wireshar 進行檢視