traffic-analysis

Traffic Analysis and Packet Capture

Overview

tcpdump, Wireshark, traffic analysis, and network diagnostics skills.

tcpdump

Basic Usage

# 监听所有接口
tcpdump -i any

# 指定接口
tcpdump -i eth0

# 详细输出
tcpdump -v
tcpdump -vv
tcpdump -vvv

Display ASCII

tcpdump -A

Display hexadecimal

tcpdump -X tcpdump -XX

Do not resolve hostnames

tcpdump -n

Do not resolve port names

tcpdump -nn

### 过滤表达式
```bash
# 主机过滤
tcpdump host 192.168.1.100
tcpdump src host 192.168.1.100
tcpdump dst host 192.168.1.100

# 网段过滤
tcpdump net 192.168.1.0/24

# 端口过滤
tcpdump port 80
tcpdump src port 80
tcpdump dst port 443
tcpdump portrange 8000-9000

# 协议过滤
tcpdump tcp
tcpdump udp
tcpdump icmp
tcpdump arp

# 组合过滤
tcpdump 'host 192.168.1.100 and port 80'
tcpdump 'src 192.168.1.100 and dst port 443'
tcpdump 'tcp and (port 80 or port 443)'
tcpdump 'not port 22'

Saving and Reading

# 保存到文件
tcpdump -w capture.pcap
tcpdump -w capture.pcap -c 1000    # 限制包数

# 读取文件
tcpdump -r capture.pcap
tcpdump -r capture.pcap -nn

# 轮转文件
tcpdump -w capture-%H%M%S.pcap -G 3600    # 每小时
tcpdump -w capture.pcap -C 100            # 每 100MB

Advanced Filtering

# TCP 标志
tcpdump 'tcp[tcpflags] & tcp-syn != 0'
tcpdump 'tcp[tcpflags] & tcp-rst != 0'
tcpdump 'tcp[tcpflags] == tcp-syn'

# HTTP 请求
tcpdump -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# DNS 查询
tcpdump -i any 'udp port 53'

# 大包
tcpdump 'greater 1000'
tcpdump 'less 100'

tshark (Wireshark CLI)

Basic Usage

# 安装
apt install tshark

# 监听
tshark -i eth0

# 指定过滤器
tshark -i eth0 -f "port 80"

# 显示过滤器
tshark -i eth0 -Y "http"

Field Extraction

# 提取特定字段
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port

# HTTP 请求
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

# DNS 查询
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name

Statistical Analysis

# 协议统计
tshark -r capture.pcap -q -z io,phs

# 会话统计
tshark -r capture.pcap -q -z conv,tcp

# HTTP 统计
tshark -r capture.pcap -q -z http,tree

# 端点统计
tshark -r capture.pcap -q -z endpoints,ip

ngrep

Basic Usage

# 安装
apt install ngrep

# 搜索内容
ngrep -q 'GET' port 80
ngrep -q 'password' port 80

# 指定接口
ngrep -d eth0 'pattern'

# 忽略大小写
ngrep -qi 'error'

iftop / nethogs

iftop

# 安装
apt install iftop

# 基础用法
iftop
iftop -i eth0

# 不解析主机名
iftop -n

# 显示端口
iftop -P

# 过滤
iftop -f "dst port 80"

nethogs

# 安装
apt install nethogs

# 按进程显示
nethogs
nethogs eth0

# 刷新间隔
nethogs -d 2

Common Scenarios

Scenario 1: HTTP Traffic Analysis

# 抓取 HTTP 请求
tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# 提取 HTTP 头
tcpdump -i any -A 'tcp port 80' | grep -E "^(GET|POST|HTTP|Host:|Content-)"

# tshark 分析
tshark -i any -Y "http.request" -T fields -e http.host -e http.request.method -e http.request.uri

Scenario 2: DNS Troubleshooting

# 抓取 DNS
tcpdump -i any -nn port 53

# 详细 DNS 信息
tcpdump -i any -vvv port 53

# tshark DNS 分析
tshark -i any -Y "dns" -T fields -e dns.qry.name -e dns.a

Scenario 3: Connection Problem Diagnosis

# TCP 握手
tcpdump -i any 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0'

# 重传
tcpdump -i any 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack != 0'

# 连接重置
tcpdump -i any 'tcp[tcpflags] & tcp-rst != 0'

Scenario 4: Bandwidth Analysis

# 实时带宽
iftop -i eth0 -P -n

# 按进程
nethogs eth0

# 统计流量
tcpdump -i eth0 -w - | pv > /dev/null

Troubleshooting

Problem	Troubleshooting Method
Packet Loss	Check tcpdump statistics, network interface queues
High Latency	Analyze RTT, retransmissions
Connection Failure	Check SYN/RST packets
Bandwidth Usage	Use iftop/nethogs

# 查看丢包
tcpdump -i eth0 -w /dev/null 2>&1 | grep -i drop

# 网卡统计
ethtool -S eth0 | grep -i error
cat /proc/net/dev

# 连接状态
ss -s
netstat -s | grep -i retrans