Unix/Solaris °ü·Ã°Ô½ÃÆÇ |
---|
2001/10/10(12:38) from 211.169.72.147 | |
ÀÛ¼ºÀÚ : °ÁÙ±â (jkkang65@hanmail.net) | Á¶È¸¼ö : 2681 , ÁÙ¼ö : 288 |
TCPDUMP User Guide |
---|
TCPDUMP User Guide Date : January 1999 written by Kwon, YongChul -------------------------------------------------------------------------------- -. ÀÌ ¹®¼ÀÇ ÀúÀÛ±ÇÀº ÀúÀÚ(±Ç¿ëö:mailto://godslord@sparcs.kaist.ac.kr)¿¡°Ô ÀÖ½À´Ï´Ù. º»¹®ÀÇ ¹«´Ü Àοë, º¹»ç´Â ÀúÀÚ¿ÍÀÇ ÇùÀÇ ¾øÀÌ Àý´ë ºÒ°¡´ÉÇÕ´Ï´Ù. -------------------------------------------------------------------------------- Table of Contents ÀÌ ¹®¼¸¦ º¸±â Àü¿¡ ¾Ë¾Æ¾ß ÇÒ »çÀü Áö½Ä Tcpdump¶õ? TcpdumpÀÇ ÆÐÅ°Áö ±¸Çϱâ TcpdumpÀÇ ¼³Ä¡ Tcpdump SourceÀÇ °£·«ÇÑ ¼³¸í TcpdumpÀÇ ¿É¼Çµé Á¶°Ç½Ä TcpdumpÀÇ »ç¿ë ¿¹Á¦µé TcpdumpÀÇ Æò°¡ References -------------------------------------------------------------------------------- ÀÌ ¹®¼¸¦ º¸±â Àü¿¡ ¾Ë¾Æ¾ß ÇÒ »çÀü Áö½Ä ÀÌ ¹®¼´Â ³×Æ®¿öÅ©ÀÇ ÆÐŶµéÀ» Àâ¾Æ³»´Â Tcpdump¶ó´Â ÇÁ·Î±×·¥¿¡ ´ëÇؼ ¼³¸íÇÏ°í ÀÖ´Ù. ÇÁ·Î±×·¥ÀÇ Æ¯¼º»ó, ³×Æ®¿öÅ©¿¡ °ü·ÃµÈ ¸¹Àº ¿ë¾îµé°ú ƯÈ÷ TCP/IP¿¡ ´ëÇÑ ³»¿ë ÀÌ ¸¹ÀÌ ³ª¿Â´Ù. µû¶ó¼ º¸´Ù Àß ÀÌÇØÇϱâ À§Çؼ´Â ³×Æ®¿öÅ© ¼³ºñ Àڷᳪ, ³×Æ®¿öÅ© ÇÁ·Î±×·¡¹Ö °¡À̵å, ȤÀº ³×Æ®¿öÅ© ÇÁ·ÎÅäÄÝ(TCP/IP)¿¡ °ü·ÃµÈ Ã¥µéÀ» ÂüÁ¶ÇÏ´Â °ÍÀÌ ÁÁÀ» °ÍÀÌ´Ù. -------------------------------------------------------------------------------- Tcpdump¶õ? Tcpdump´Â ÁÖ¾îÁø Á¶°Ç½ÄÀ» ¸¸Á·ÇÏ´Â ³×Æ®¿öÅ© ÀÎÅÍÆäÀ̽º¸¦ °ÅÄ¡´Â ÆÐŶµéÀÇ Çì´õµé À» Ãâ·ÂÇØ ÁÖ´Â ÇÁ·Î±×·¥ÀÌ´Ù. ÇÁ·Î±×·¥ÀÇ Æ¯¼º»ó, ³×Æ®¿öÅ© ÀÎÅÍÆäÀ̽º¸¦ ¾ÆÁÖ ½Éµµ ÀÖ°Ô »ç¿ëÇϱ⠶§¹®¿¡, ½ÇÇàÇÏ´Â »ç¶÷Àº ¹Ýµå½Ã ³×Æ®¿öÅ© ÀÎÅÍÆäÀ̽º¿¡ ´ëÇÑ ÀÐ±â ±Ç ÇÑÀÌ ÀÖ¾î¾ß¸¸ ÇÑ´Ù. OS dependent) À§¿¡¼ ¸»ÇÏ´Â Àб⠱ÇÇÑÀ» °¡Áö°í ÀÖ¾î¾ß ÇÏ´Â ÆÄÀÏ, ȤÀº TcpdumpÀÇ ÆÛ¹Ì¼Ç ÀÌ´Ù. SunOS : /dev/nit, /dev/bpf* Solaris(SunOS 5.x) : /dev/le µî HP-UX & IRIX & Linux : root¿¡¼ ½ÇÇàÇϰųª, root·Î setuid¸¦ ¼³Á¤ÇØ¾ß ÇÔ Ultrix & Digital UNIX : root°¡ pfconfig¸¦ ÀÌ¿ëÇÏ¿©, promiscuous-mode¸¦ °¡´ÉÇÏ°Ô ¼³Á¤ÇÏ¸é ¾î¶² À¯Àú¶óµµ »ç¿ëÇÒ ¼ö ÀÖ´Ù. BSD : /dev/bpf* -------------------------------------------------------------------------------- TcpdumpÀÇ ÆÐÅ°Áö ±¸Çϱâ Tcpdump´Â ftp://ftp.ee.lbl.gov/tcpdump.tar.Z¿¡¼ ÃֽŠ¹öÀüÀ» ±¸ÇÒ ¼ö ÀÖ´Ù. À¯¸í ÇÑ ÇÁ·Î±×·¥À̱⠶§¹®¿¡, ½Ã½ºÅÛ¼ÒÇÁÆ®¿þ¾î¸¦ ÆÐÅ°ÁöÇüÅ·ΠÁ¦°øÇØ ÁÖ´Â OSµéÀÇ °æ¿ì Vendor¿¡¼ ÆÐŰ¡µÈ(ÄÄÆÄÀϵÈ) ¹öÀüÀ¸·Îµµ ±¸ÇÒ ¼ö ÀÖÀ» °ÍÀÌ´Ù. -------------------------------------------------------------------------------- TcpdumpÀÇ ¼³Ä¡ Tcpdump´Â libpcap(Protocol Capture Library)¶ó´Â °ÍÀ» »ç¿ëÇÑ´Ù. ÀÌ ¶óÀ̺귯¸®´Â Platform¿¡ »ó°ü¾øÀÌ µ¿ÀÏÇÑ ¹æ¹ýÀ¸·Î »ç¿ëÀÚ ·¹º§¿¡¼ ÆÐŶµéÀ» ĸÃçÇÒ ¼ö ÀÖ°Ô ÇØ ÁØ´Ù. µû¶ó¼ ÀÌ ¶óÀ̺귯¸®°¡ ¾ø´Ù¸é, ftp://ftp.ee.lbl.gov/libpcap.tar.Z¿¡¼ ±¸ÇÏ ¿© ¼³Ä¡Çϵµ·Ï ÇÑ´Ù. ANSI C ÄÄÆÄÀÏ·¯´Â ¾Æ¸¶ ´ëºÎºÐÀÇ ½Ã½ºÅÛ¿¡¼ ±¸ºñÇÏ°í ÀÖÀ» °ÍÀÌ´Ù. ¸¸¾à ¾ø´Ù¸é ftp://prep.ai.mit.edu/pub/gnu/gcc.tar.gz¸¦ ¹Þ¾Æ¼ ¼³Ä¡Çϱ⠹ٶõ´Ù. libpcap¶óÀ̺귯¸®°¡ ¿Ïº®ÇÏ°Ô ¼³Ä¡µÇ¾ú´Ù´Â °¡Á¤ÇÏ¿¡¼ ´ÙÀ½ÀÇ ÀýÂ÷¿¡ µû¶ó ¼³Ä¡¸¦ ½ÃÀÛÇÑ´Ù. Makefile.inÀÇ BINDEST¿Í MANDEST Ç׸ñ¿¡ °¢°¢, tcpdump ½ÇÇàÆÄÀÏ°ú ¸Þ´º¾ó ÆäÀÌ Áö°¡ ¼³Ä¡µÉ µð·ºÅ丮µéÀ» ÀÔ·ÂÇØ ÁØ´Ù. Tcpdump ÆÐÅ°Áö¿Í ÇÔ²² Á¦°øµÇ´Â ./configure ½ºÅ©¸³Æ®¸¦ ½ÇÇà½ÃŲ´Ù. ÀÌ ½ºÅ©¸³Æ®´Â ÇöÀç ½Ã½ºÅÛÀÇ È¯°æµéÀ» °Ë»çÇÏ°í ÀÌ¿¡ ¸ÂÃß¾î¼ MakefileÀ» »ý¼ºÇØ ÁØ´Ù. make¸¦ ½ÇÇàÇÑ´Ù. ÄÄÆÄÀÏÀÌ ´Ù µÆÀ¸¸é, make installÀ» ¼öÇàÇÏ¿© ½ÇÇàÆÄÀÏÀ» ¼³Ä¡ÇÏ°í, make install-manÀ» ½ÇÇàÇÏ¿© ¸Þ´º¾ó ÆäÀÌÁöµµ ¼³Ä¡ÇÑ´Ù. tcpdumpÀÇ Æ۹̼ÇÀÌ Á¦´ë·Î µÇ¾ú´ÂÁö¸¦ °Ë»çÇÑ´Ù. setgid°¡ ¼³Á¤µÇ¾î Àֱ⠶§¹®¿¡, ¿øÇÏÁö ¾Ê´Â »ç¶÷ÀÌ ½ÇÇàÇÏ°Ô µÈ´Ù¸é À§ÇèÇÏ´Ù. À§¿¡¼ ¼³¸íÇÑ ÀýÂ÷¸¦ ±×´ë·Î ¿Å°Ü º»´Ù. # vi Makefile.in # ./configure # make # make install # make install-man OS dependent) DEC/OSF and BSD/386, etc : tcpdump°¡ OS¿Í ÇÔ²² Á¦°øµÇ´Â °æ¿ì°¡ ÀÖ´Ù. ÀÌ·² °æ¿ì tcpdump¸¦ ¾÷±×·¹À̵å Çϱâ Àü¿¡ ¹Ýµå½Ã ±âÁ¸ÀÇ tcpdump¸¦ ¹é¾÷ÇØ µÎµµ·Ï ÇÏÀÚ. Linux : libpcap ¶óÀ̺귯¸®´Â 2.0.25 Ä¿³Î¿¡¼ Å×½ºÆ® µÆ´Ù. 2.0.x ´ë Ä¿³Î ¿¡¼ 25ÀÌÇÏÀÇ ¹öÀü¿¡¼´Â ½ÇÇàÀÌ ¾Æ¸¶ °¡´ÉÇÒ °ÍÀÌ´Ù. ±×·¯³ª 1.x´ëÀÇ Ä¿³Î¿¡¼´Â µ¿ÀÛ ¿©ºÎ°¡ ÀÔÁõµÇÁö ¾Ê¾ÒÀ¸¹Ç·Î ÁÖÀÇÇØ¾ß ÇÑ´Ù. OSF 4 : OSF4¿¡¼´Â stack C ÄÄÆÄÀÏ·¯¿¡ Ä¡¸íÀûÀÎ ¹ö±×°¡ ÀÖ´Ù. ÀÌ ¹ö±×¸¦ ÇÇÇØ°¡·Á¸é, ./configure¸¦ ½ÇÇàÇÑ ÈÄ ÄÄÆÄÀÏ Çϱâ Àü¿¡ Makefile¿¡¼ ´ÙÀ½ÀÇ ¹®ÀåÀ» »èÁ¦ÇÑ ÈÄ ÄÄÆÄÀÏÇØ ÁÖ¸é µÈ´Ù. -DETHER_HEADER_HAS_EA=1 -DETHER_ARP_HAS_EA=1 -------------------------------------------------------------------------------- Tcpdump SourceÀÇ °£·«ÇÑ ¼³¸í -------------------------------------------------------------------------------- TcpdumpÀÇ ¿É¼Çµé -a : Network & Broadcast ÁÖ¼ÒµéÀ» À̸§µé·Î ¹Ù²Û´Ù. -c Number : Á¦½ÃµÈ ¼öÀÇ ÆÐŶÀ» ¹ÞÀº ÈÄ Á¾·áÇÑ´Ù. -d : comileµÈ packet-matching code¸¦ »ç¶÷ÀÌ ÀÐÀ» ¼ö ÀÖµµ·Ï ¹Ù²Ù¾î Ç¥ÁØ Ãâ·ÂÀ¸·Î Ãâ·ÂÇÏ°í, Á¾·áÇÑ´Ù. -dd : packet-matching code¸¦ C programÀÇ ÀϺηΠÃâ·ÂÇÑ´Ù. -ddd : packet-matching code¸¦ ¼ýÀÚ·Î Ãâ·ÂÇÑ´Ù. -e : Ãâ·ÂµÇ´Â °¢°¢ÀÇ Çà¿¡ ´ëÇؼ link-level Çì´õ¸¦ Ãâ·ÂÇÑ´Ù. -f : ¿ÜºÎÀÇ internet address¸¦ °¡±ÞÀû ½Éº¼·Î Ãâ·ÂÇÑ´Ù(SunÀÇ yp server¿ÍÀÇ »ç¿ëÀº °¡±ÞÀû ÇÇÇÏÀÚ). -F file : filter Ç¥ÇöÀÇ ÀÔ·ÂÀ¸·Î ÆÄÀÏÀ» ¹Þ¾ÆµéÀδÙ. Ä¿¸Çµå¶óÀο¡ ÁÖ¾îÁø Ãß°¡ÀÇ Ç¥ÇöµéÀº ¸ðµÎ ¹«½ÃµÈ´Ù. -i device : ¾î´À ÀÎÅÍÆäÀ̽º¸¦ °æÀ¯ÇÏ´Â ÆÐŶµéÀ» ÀâÀ»Áö ÁöÁ¤ÇÑ´Ù. ÁöÀúµÇÁö ¾ÊÀ¸¸é ½Ã½ºÅÛÀÇ ÀÎÅÍÆäÀ̽º ¸®½ºÆ®¸¦ µÚÁ®¼ °¡Àå ³·Àº ¹øÈ£¸¦ °¡Áø ÀÎÅÍÆäÀ̽º¸¦ ¼±ÅÃÇÑ´Ù(ÀÌ ¶§ loopbackÀº Á¦¿ÜµÈ´Ù). -l : Ç¥ÁØ Ãâ·ÂÀ¸·Î ³ª°¡´Â µ¥ÀÌÅ͵éÀ» line bufferingÇÑ´Ù. ´Ù¸¥ ÇÁ·Î±×·¥¿¡¼ tcpdump·ÎºÎÅÍ µ¥ÀÌÅ͸¦ ¹Þ°íÀÚ ÇÒ ¶§, À¯¿ëÇÏ´Ù. -n : ¸ðµç ÁÖ¼ÒµéÀ» ¹ø¿ªÇÏÁö ¾Ê´Â´Ù(port,host address µîµî) -N : È£½ºÆ® À̸§À» Ãâ·ÂÇÒ ¶§, µµ¸ÞÀÎÀ» ÂïÁö ¾Ê´Â´Ù. -O : packet-matching code optimizer¸¦ ½ÇÇàÇÏÁö ¾Ê´Â´Ù. ÀÌ ¿É¼ÇÀº optimizer¿¡ ÀÖ´Â ¹ö±×¸¦ ãÀ» ¶§³ª ¾²ÀδÙ. -p : ÀÎÅÍÆäÀ̽º¸¦ promiscuous mode·Î µÎÁö ¾Ê´Â´Ù. -q : ÇÁ·ÎÅäÄÝ¿¡ ´ëÇÑ Á¤º¸¸¦ ´ú Ãâ·ÂÇÑ´Ù. µû¶ó¼ Ãâ·ÂµÇ´Â ¶óÀÎÀÌ Á» ´õ ª¾ÆÁø´Ù. -r file : ÆÐŶµéÀ» '-w'¿É¼ÇÀ¸·Î ¸¸µé¾îÁø ÆÄÀÏ·Î ºÎÅÍ ÀÐ¾î µéÀδÙ. ÆÄÀÏ¿¡ "-" °¡ »ç¿ëµÇ¸é Ç¥ÁØ ÀÔ·ÂÀ» ÅëÇؼ ¹Þ¾ÆµéÀδÙ. -s length: ÆÐŶµé·ÎºÎÅÍ ÃßÃâÇÏ´Â »ùÇÃÀ» default°ªÀÎ 68Byte¿ÜÀÇ °ªÀ¸·Î ¼³Á¤ÇÒ ¶§ »ç¿ëÇÑ´Ù(SunOSÀÇ NIT¿¡¼´Â ÃÖ¼Ò°¡ 96ByteÀÌ´Ù). 68Byte´Â IP,ICMP, TCP, UDPµî¿¡ ÀûÀýÇÑ °ªÀÌÁö¸¸ Name Server³ª NFS ÆÐŶµéÀÇ °æ¿ì¿¡´Â ÇÁ·ÎÅäÄÝÀÇ Á¤º¸µéÀ» TruncationÇÒ ¿ì·Á°¡ ÀÖ´Ù. ÀÌ ¿É¼ÇÀ» ¼öÁ¤ÇÒ ¶§´Â ½ÅÁßÇؾ߸¸ ÇÑ´Ù. ÀÌÀ¯´Â »ùÇà »çÀÌÁ Å©°Ô ÀâÀ¸¸é °ð ÆÐŶ ÇϳªÇϳª¸¦ ó¸®Çϴµ¥ ½Ã°£ÀÌ ´õ °É¸± »Ó¸¸¾Æ´Ï¶ó ÆÐŶ ¹öÆÛÀÇ »çÀÌÁîµµ ÀÚ¿¬È÷ ÀÛ¾ÆÁö°Ô µÇ¾î ¼Õ½ÇµÇ´Â ÆÐŶµéÀÌ ¹ß»ýÇÒ ¼ö Àֱ⠶§¹®ÀÌ´Ù. ¶Ç, ÀÛ°Ô ÀâÀ¸¸é ±×¸¸ÅÀÇ Á¤º¸¸¦ ÀҰԵǴ °ÍÀÌ´Ù. µû¶ó¼ °¡±ÞÀû ĸÃçÇÏ°íÀÚ ÇÏ´Â ÇÁ·ÎÅäÄÝÀÇ Çì´õ »çÀÌÁî¿¡ °¡±õ°Ô Àâ¾ÆÁÖ¾î¾ß ÇÑ´Ù. -T type : Á¶°Ç½Ä¿¡ ÀÇÇØ ¼±ÅÃµÈ ÆÐŶµéÀ» ¸í½ÃµÈ Çü½ÄÀ¸·Î Ç¥½ÃÇÑ´Ù. type¿¡´Â ´ÙÀ½°ú °°Àº °ÍµéÀÌ ¿Ã ¼ö ÀÖ´Ù. rpc(Remote Procedure Call), rtp(Real-Time Applications protocol), rtcp(Real-Time Application control protocal), vat(Visual Audio Tool), wb(distributed White Board) -S : TCP sequence¹øÈ£¸¦ »ó´ëÀûÀÎ ¹øÈ£°¡ ¾Æ´Ñ Àý´ëÀûÀÎ ¹øÈ£·Î Ãâ·ÂÇÑ´Ù. -t : Ãâ·ÂµÇ´Â °¢°¢ÀÇ ¶óÀο¡ ½Ã°£À» Ãâ·ÂÇÏÁö ¾Ê´Â´Ù. -tt : Ãâ·ÂµÇ´Â °¢°¢ÀÇ ¶óÀο¡ Çü½ÄÀÌ ¾ø´Â ½Ã°£µéÀ» Ãâ·ÂÇÑ´Ù. -v : Á» ´õ ¸¹Àº Á¤º¸µéÀ» Ãâ·ÂÇÑ´Ù. -vv : '-v'º¸´Ù Á» ´õ ¸¹Àº Á¤º¸µéÀ» Ãâ·ÂÇÑ´Ù. -w : ĸÃçÇÑ ÆÐŶµéÀ» ºÐ¼®Çؼ Ãâ·ÂÇÏ´Â ´ë½Å¿¡ ±×´ë·Î ÆÄÀÏ¿¡ ÀúÀåÇÑ´Ù. -x : °¢°¢ÀÇ ÆÐŶÀ» Çí»çÄÚµå·Î Ãâ·ÂÇÑ´Ù. Á¶°Ç½Ä(expression) ¿É¼ÇÀÇ Á¦ÀÏ ¸¶Áö¸·ÀÎ Á¶°Ç½ÄÀº ¾î¶² ÆÐŶµéÀ» Ãâ·ÂÇÒÁö¸¦ ¼±ÅÃÇϴµ¥ ¾²ÀδÙ. Á¶°Ç½ÄÀÌ ÁÖ¾îÁöÁö ¾Ê´Â ´Ù¸é ¸ðµç ÆÐŶµéÀÌ ±× ´ë»óÀÌ µÉ °ÍÀÌ´Ù. ÀÏ´Ü ÁÖ¾îÁö¸é, ¾Æ¹«¸® ÆÐŶµéÀÌ ¸¹¾Æµµ Á¶ °Ç½Ä¿¡ ºÎÇÕÇÏ´Â ÆÐŶ¸¸À» Ãâ·ÂÇÑ´Ù. Á¶°Ç½ÄµéÀº Çϳª ¶Ç´Â ¸î °³ÀÇ primitiveµé·Î ±¸¼ºµÇ¾î ÀÖ´Ù. primitiveµéÀº º¸Åë Çϳª ȤÀº ¸î°³ÀÇ qualifierµé ´ÙÀ½¿¡ ¿À´Â ÇϳªÀÇ °ªÀ¸·Î ÀÌ·ç¾îÁø´Ù. QualifierµéÀº ¸ðµÎ 3 Á¾·ùÀÌ¸ç ´ÙÀ½°ú °°´Ù. type : ÁÖ¾îÁø °ªÀÇ Á¾·ù°¡ ¹«¾ùÀÎÁö¸¦ ³ªÅ¸³½´Ù. °¡´ÉÇÑ typeµéÀº 'host', 'net', 'port'°¡ ÀÖ´Ù. typeÀÌ ¾ø´Â °ªµéÀº typeÀ» host¶ó °¡Á¤ÇÑ´Ù. dir : id·Î ºÎÅÍÀÇ ¾î¶² ƯÁ¤ÇÑ Àü¼Û ¹æÇâÀ» ³ªÅ¸³½´Ù. °¡´ÉÇÑ ¹æÇâÀº 'src', 'dst', 'src or dst', 'src and dst'ÀÌ´Ù. ¸¸¾à ¹æÇâÀÌ Á¤ÇØÁöÁö ¾Ê¾Ò´Ù¸é, src or dst¶ó °¡Á¤ÇÑ´Ù. "For `null' link layers (i.e. point to point protocols such as slip) the inb ound and out bound qualifiers can be used to specify a desired direction." proto : ¸ÅĪÀ» ƯÁ¤ ÇÁ·ÎÅäÄÝ¿¡ ÇÑÇؼ ¼öÇàÇÑ´Ù. °¡´ÉÇÑ ÇÁ·ÎÅäÄݵéÀº ether, fddi, ip, arp, rarp, decnet, lat, sca, moprc, mopdl, tcp, udpÀÌ´Ù. ¸¸¾à ÇÁ·ÎÅäÄÝÀÌ ¸í½ÃµÇÁö ¾Ê¾Ò´Ù¸é, ÇØ´çÇÏ´Â °ªÀÇ type¿¡ °ü·ÃµÈ ¸ðµç ÇÁ·ÎÅäÄݵéÀÌ ±× ´ë»óÀÌ µÈ´Ù. ÀÌ ¹Û¿¡µµ À§ÀÇ ÆÐÅÏÀ» µû¸£Áö ¾Ê´Â PrimitiveµéÀÌ Á¸ÀçÇÑ´Ù(gateway, broadcst, less, greater, »ê¼ú½Ä). Á» ´õ Á¤±³ÇÑ Á¶°Ç½ÄµéÀ» »ç¿ëÇÏ·Á¸é, 'and(&&)', 'or(||)', 'not(!)'µéÀ» »ç¿ëÇÏ¿© ¿©·¯ primitiveµéÀ» ¿¬°áÇÏ¸é µÈ´Ù. °°Àº Ç¥ÇöµéÀº »ý·«µÉ ¼ö ÀÖ´Ù. »ç¿ë °¡´ÉÇÑ Primitiveµé dst host HOST packetÀÇ IP destination Ç׸ñÀÌ HOSTÀ϶§ ÂüÀÌ µÈ´Ù. src host HOST packetÀÇ IP source Ç׸ñÀÌ HOSTÀ϶§ ÂüÀÌ µÈ´Ù. host HOST IP source, IP destination Ç׸ñ Áß ¾î´À Çϳª¶óµµ HOSTÀ̸é ÂüÀÌ´Ù. ether dst ehost ethernet destination ÁÖ¼Ò°¡ ehostÀÏ ¶§ ÂüÀÌ´Ù. ether src ehost ethernet source ÁÖ¼Ò°¡ ehostÀÏ ¶§ ÂüÀÌ´Ù. ether host ehost ethernet source, destination Ç׸ñµé Áß ¾î´À Çϳª¶óµµ ehostÀ̸é ÂüÀÌ´Ù. gateway host ÆÐŶÀÌ host¸¦ °ÔÀÌÆ®¿þÀÌ·Î »ç¿ëÇϸé ÂüÀÌ´Ù. ÀÌ ¸»ÀÇ Àǹ̴ ethernet sour ce³ª destination Ç׸ñÀº hostÀÌÁö¸¸, IP source¿Í destinationÀº host°¡ ¾Æ´Ò ¶§¸¦ ¸»ÇÑ´Ù. dst net NET ÆÐŶÀÇ IP destination ÁÖ¼Ò°¡ NETÀÇ network number¸¦ °¡Áö°í ÀÖÀ» ¶§ ÂüÀÌ ´Ù. src net NET ÆÐŶÀÇ IP source ÁÖ¼Ò°¡ NETÀÇ network number¸¦ °¡Áö°í ÀÖÀ» ¶§ ÂüÀÌ´Ù. net NET ÆÐŶÀÇ IP source ÁÖ¼Ò È¤Àº destination ÁÖ¼Ò°¡ NETÀÇ network number¸¦ °¡ Áö°í ÀÖÀ» ¶§ ÂüÀÌ´Ù. net netmask mask IP ¾îµå·¹½º°¡ ÁöÁ¤µÈ netmask¸¦ ÅëÇؼ net°ú ¸ÅĪµÇ¸é ÂüÀÌ´Ù. net net/len IP ¾îµå·¹½º°¡ netmask¿Í len ºñÆ®¸¸Å ¸ÅÄ¡µÇ¸é ÂüÀÌ´Ù. dst port PORT ÆÐŶÀÌ ip/tcp, ip/udp ÇÁ·ÎÅäÄÝÀÇ ÆÐŶÀÌ°í destination portÀÇ °ªÀÌ PORTÀÏ ¶§ ÂüÀÌ´Ù. port´Â /etc/services¿¡ ¸í½ÃµÈ À̸§ÀÏ ¼öµµ ÀÖ°í ±×³É ¼ýÀÚÀÏ ¼öµµ ÀÖ´Ù. ¸¸¾à À̸§ÀÌ »ç¿ëµÆ´Ù¸é port ¹øÈ£¿Í ÇÁ·ÎÅäÄÝÀÌ °°ÀÌ Ã¼Å©µÉ °ÍÀÌ´Ù. ¸¸¾à ¼ýÀÚ³ª ºÒ È®½ÇÇÑ À̸§ÀÌ »ç¿ëµÆÀ» °æ¿ì¿¡´Â port ¹øÈ£¸¸ÀÌ Ã¼Å©µÉ °ÍÀÌ´Ù. src port PORT ÆÐŶÀÇ source portÀÇ °ªÀ¸·Î PORT¸¦ °¡Áö¸é ÂüÀÌ´Ù. port PORT ÆÐŶÀÇ source, destination port Áß¿¡ Çϳª¶óµµ PORTÀ̸é ÂüÀÌ´Ù. less length ÆÐŶÀÌ lengthº¸´Ù ª°Å³ª °°À¸¸é ÂüÀÌ´Ù.(len <= length) greater length ÆÐŶÀÌ lengthº¸´Ù ª°Å³ª °°À¸¸é ÂüÀÌ´Ù.(len >= length) ip proto protocol ÆÐŶÀÌ ÁöÁ¤µÈ Á¾·ùÀÇ ÇÁ·ÎÅäÄÝÀÇ ipÆÐŶÀ̸é ÂüÀÌ´Ù. ProtocolÀº icmp, igrp, udp, nd, tcp ÁßÀÇ Çϳª ȤÀº ¸î °³°¡ µÉ ¼ö ÀÖ´Ù. ÁÖÀÇÇÒ Á¡Àº tcp, udp, icmpµéÀº '\'·Î escapeµÇ¾î¾ß ÇÑ´Ù. ehter broadcast ÆÐŶÀÌ ethernet broadcast ÆÐŶÀ̶ó¸é ÂüÀÌ´Ù. ehter´Â »ý·« °¡´ÉÇÏ´Ù. ip broadcast ÆÐŶÀÌ IP broadcast ÆÐŶÀ̶ó¸é ÂüÀÌ´Ù. ether multicast ÆÐŶÀÌ IP multicast ÆÐŶÀ̶ó¸é ÂüÀÌ´Ù. ether proto protocol ÆÐŶÀÌ ether typeÀÇ protocolÀ̶ó¸é ÂüÀÌ´Ù. protocolÀº ip, arp, rarp Áß¿¡ Çϳª ȤÀº ¸î°³°¡ µÉ ¼ö ÀÖ´Ù. ip proto protocol¿¡¼¿Í ¸¶Âù°¡Áö·Î ip, arp, rarp´Â escape µÇ¾î¾ß ÇÑ´Ù. decnet src host ¸¸¾à DECNETÀÇ source address°¡ hostÀ̸é ÂüÀÌ´Ù. ÀÌ ¾îµå·¹½º´Â '10.123'ÀÌ ³ª DECNETÀÇ host nameÀÏ ¼ö ÀÖ´Ù. DECNET host nameÀº DECNET¿¡¼ µ¹¾Æ°¡µµ·Ï ¼³Á¤µÈ Ultrix ½Ã½ºÅÛ¿¡¼¸¸ »ç¿ë °¡´ÉÇÏ´Ù. decnet dst host DECNET destination address°¡ hostÀ̸é ÂüÀÌ´Ù. decnet host HOST DECNET source, destination addressÁßÀÇ Çϳª¶óµµ HOSTÀ̸é ÂüÀÌ´Ù. ip, arp, rarp, decnet ether proto [ip|arp|rarp|decnet]ÀÇ ¾à¾î lat, moprc, mopdl ether proto [lat|moprc|mopdl]ÀÇ ¾à¾î tcp, udp, icmp ip proto [tcp|udp|icmp]ÀÇ ¾à¾î expr relop expr EXPR proto [expr:size]ÀÇ Çü½ÄÀ» ¶í´Ù. proto, expr, size¿¡ ¿Ã ¼ö ÀÖ´Â °ÍµéÀº ´ÙÀ½°ú °°´Ù. proto : ether, fddi, ip, arp, rarp, tcp, udp, icmp expr : indicate Byte offset of packet of proto size : optional. indicate the size of bytes in field of interest default is one, and can be two or four RELOP !=, =, <=, >=, etc. ÀÌ Á¶°Ç½ÄÀ» »ç¿ëÇϱâ À§Çؼ´Â ¸ÕÀú ÇØ´çÇÏ´Â Protocol(proto)ÀÇ Çì´õ¿¡ °ü·ÃµÈ °ÍµéÀ» ÀÚ¼¼È÷ ¾Ë¾Æ¾ß¸¸ ÇÑ´Ù. proto¿¡´Â ´ë»óÀÌ µÉ ÇÁ·ÎÅäÄÝÀ» ÁöÁ¤ÇÑ´Ù. expr¿¡´Â ÇÁ·ÎÅäÄÝ Çì´õÀÇ Ã³À½ºÎÅÍÀÇ Byte OffsetÀ» ÁöÁ¤ÇÏ´Â ½ÄÀÌ µé¾î°¡°Ô µÈ´Ù. Size´Â OptionÀ̸ç ÁöÁ¤ÀÌ ¾È µÇ¾î ÀÖÀ» °æ¿ì¿¡´Â ÀÚµ¿À¸·Î 1byte¸¦ ÁöĪÇÑ´Ù. µû¶ó¼ ÀÌ Á¶°Ç½ÄÀ» »ç¿ëÇÏ°Ô µÇ¸é Çì´õ¿¡ Æ÷ÇÔµÈ Á¤º¸¸¦ Bitmask¸¦ »ç¿ëÇÏ¿© Á÷ Á¢ ¿øÇÏ´Â ÆÐŶÀÎÁö¸¦ °¡·Á³¾ ¼ö Àֱ⠶§¹®¿¡, º¸´Ù Á¤¹ÐÇÑ »ç¿ëÀÌ °¡´ÉÇÏ°Ô µÈ´Ù. -------------------------------------------------------------------------------- TcpdumpÀÇ »ç¿ë ¿¹Á¦µé security¶ó´Â È£½ºÆ®·ÎºÎÅÍ ³¯¾Æ¿À°í, ³¯¾Æ°¡´Â ÆÐŶµéÀ» Ãâ·Â # tcpdump host security security¿Í mazinga, getarobo »çÀÌ¿¡ ³¯¾Æ´Ù´Ï°í ÀÖ´Â ÆÐŶµéÀ» Ãâ·Â # tcpdump host security and \( mazinga or getarobo \) security¿¡¼ elgaimÀ» Á¦¿ÜÇÑ ¸ðµç È£½ºÆ®·Î ³¯¾Æ´Ù´Ï´Â IP ÆÐŶµéÀ» Ãâ·Â # tcpdump ip host security and not elgaim gateway amurorei¸¦ °ÅÄ¡´Â ftp¿¡ °ü·ÃµÈ ÆÐŶµéÀ» Ãâ·Â # tcpdump 'gateway amurorei and ( port ftp or ftp-data )' localÈ£½ºÆ®°¡ ¾Æ´Ñ È£½ºÆ®¿Í ·ÎÄÃÈ£½ºÆ®°¡ ¸Î´Â TCP Ä¿³Ø¼ÇÀÇ ½ÃÀÛ°ú ¸¶Áö¸· ÆРŶµéÀ» Ãâ·ÂÇÑ´Ù(SYN, FIN ÆÐŶ). # tcpdump 'tcp[13] & 3 != 0 and not src and dst net non-local' gateway amurorei¸¦ Áö³ª´Â 576Byteº¸´Ù Å« ÆÐŶµéÀ» Ãâ·ÂÇÑ´Ù # tcpdump 'gateway amurorei and ip[2:2] > 576' Ethernet boradcast ȤÀº multicast¸¦ ÅëÇؼ º¸³»Áø °ÍÀÌ ¾Æ´Ñ, IP broadcast Ȥ Àº multicast ÆÐŶµéÀ» Ãâ·ÂÇÑ´Ù. # tcpdump 'ehter[0] & 1 = 0 and ip[16] >= 224' Echo request/reply°¡ ¾Æ´Ñ ICMP ÆÐŶµéÀ» ¸ðµÎ Ãâ·ÂÇÑ´Ù. # tcpdump 'icmp[0] != 8 and icmp[0] != 0' -------------------------------------------------------------------------------- TcpdumpÀÇ Æò°¡ TCPDUMP´Â ¿©·¯¸ð·Î ÁÁÀº ÅøÀÌ´Ù. libpcapÀ» °ÅÀÇ 100% È°¿ëÇÑ ÇÁ·Î±×·¥ÀÇ ¿¹À̸ç, ½ÇÁ¦·Î ¸¹Àº ÅøµéÀÌ TCPDUMP¿Í º´ÇàÇÏ¿© µ¹¾Æ°¡°Å³ª, TCPDUMP¸¦ ±â¹ÝÀ¸·Î Á¦À۵Ǿú´Ù. TCPDUMPÀÇ ¸·°ÇÑ packet filter´Â ÇöÀç ·ÎÄà ³×Æ®¿öÅ© »ó¿¡¼ ³¯¾Æ´Ù´Ï°í Àִ ƯÁ¤ÇÑ ÆÐŶµéÀ» ½Ç½Ã°£À¸·Î ±â·ÏÇØ ÁÙ ¼ö ÀÖÀ¸¸ç, À̸¦ ÀÌ¿ëÇÏ¿© ³×Æ®¿öÅ©¿¡¼ ¹ú¾îÁö´Â ÀϵéÀ» ³×Æ®¿öÅ© °ü¸®ÀÚ°¡ ¿øÇÏ´Â ´ë·Î »Ì¾Æ º¼ ¼ö ÀÖ°Ô ÇØ ÁØ´Ù. ¶ÇÇÑ, ½Ã½ºÅÛ °ü¸®Àڵ鿡°Ô´Â ·ÎÄà À¯ÀúÀÇ ¿ÜºÎ·ÎÀÇ Ä¿³Ø¼ÇµéÀ» °¨½ÃÇÏ°í, ¶Ç ƯÁ¤ ħÀÔÀÚ°¡ ħÅõ °æ·Î·Î ÀÚÁÖ ÀÌ¿ëÇϴ ȣ½ºÆ®, ȤÀº ¿øÇÏÁö ¾Ê´Â È£½ºÆ®·ÎºÎÅÍÀÇ Ä¿³Ø¼ÇÀ» ½Ç½Ã°£À¸·Î °¨½ÃÇÒ ¼ö ÀÖ°Ô ÇØ ÁØ´Ù. libpcapÀ» ÀÌ¿ëÇÏ¿© ºñ½ÁÇÑ ÅøÀ» Á¦ÀÛÇÏ°íÀÚ ÇÏ´Â »ç¶÷µé¿¡°Ôµµ TCPDUMP´Â °¡Àå ÈǸ¢ÇÑ ¿¹Á¦°¡ µÉ °ÍÀÌ´Ù. -------------------------------------------------------------------------------- References TCP dump Manual page : written by Van Jacobson, Craig Leres and Steven McCanne, all of the Lawrence Berkeley National Laboratory, University of California, Berkeley, CA. TCP dump Document included in TCP dump package |