[问题求助][RedHat] tcpdump能否指定标志位进行抓包? [复制链接]

如题.,如果行,望哥们儿些指点下..

你说的标志为是什么标志位？
我觉得可能做不到，至少man里没看到

try  wireshark

man tcpdump
       Capturing  TCP packets with particular flag combinations (SYN-ACK, URG-
       ACK, etc.)

       There are 8 bits in the control bits section of the TCP header:

              CWR | ECE | URG | ACK | PSH | RST | SYN | FIN

       Let’s assume that we want to watch packets used in establishing  a  TCP
       connection.   Recall  that  TCP uses a 3-way handshake protocol when it
       initializes a new connection; the connection sequence  with  regard  to
       the TCP control bits is

              1) Caller sends SYN
              2) Recipient responds with SYN, ACK
              3) Caller sends ACK

tcpdump 是比较简陋的工具