我通过使用 ssh 将命令发送到控制 Tcpdump 的 shell 脚本远程捕获服务器接口上的流量。
#!/bin/bash
# Script to Start/Stop TCP
# Usage: ./ControlTCPdump.sh start|stop [filename]
CONSOLE_OUTPUT="tcpdump$( date +%m%d ).console"
HOST_NAME=`hostname`
#Default filename:
if [ "$2" = "" ]; then
FILENAME="traffic.dmp"
else
FILENAME=$2
fi
if [ "$1" = start ]; then
echo $(date) $FILENAME >> $CONSOLE_OUTPUT
if [ "" = "$(pidof tcpdump)" ]; then
nohup tcpdump -s 96 -w $FILENAME -i em2 -n tcp > /dev/null &>> $CONSOLE_OUTPUT &
echo [$HOST_NAME] TCPdump is started\!
else
echo [$HOST_NAME] There is runnung process. Kill All\!
killall -q tcpdump #Quiet, don't talk
sleep 1
if [ "" = "$(pidof tcpdump)" ]; then
echo [$HOST_NAME] Restarting TCPdump...
nohup tcpdump -s 96 -w $FILENAME -i em2 -n tcp >/dev/null &>> $CONSOLE_OUTPUT &
echo [$HOST_NAME] TCPdump is started\!
else
echo [$HOST_NAME] Error\! Cannot kill them\!
exit 0
fi
fi
else
if [ "$1" = stop ]; then
TD=`pidof tcpdump`
if [ -n "$TD" ]; then
kill "$TD"
fi
sleep 1
if [ "" = "$(pidof tcpdump)" ]; then
echo [$HOST_NAME] TCPdump is stopped\!
else
echo [$HOST_NAME] Error\! Cannot kill them\!
exit 0
fi
else
echo [$HOST_NAME] Syntax error\!
exit 0
fi
fi
报告称它已经捕获了数千个数据包。但是当我看到 tcpdump cap 文件时,它是空的,并且在使用 tcptrace 读取时出现问题。
...
Mon Mar 25 23:25:48 CET 2013 CapturedTraffic201303252230/Traffic30.dmp
tcpdump: listening on em2, link-type EN10MB (Ethernet), capture size
96 bytes 1403831 packets captured 1403831 packets received by filter 0
packets dropped by kernel Mon Mar 25 23:27:28 CET 2013
CapturedTraffic201303252230/Traffic31.dmp tcpdump: listening on em2,
link-type EN10MB (Ethernet), capture size 96 bytes 1378692 packets
captured 1378692 packets received by filter 0 packets dropped by
kernel
...
现象是这样的(我用“ls -l”查看文件大小):
...
-rw-r--r--. 1 root root 105206180 Mar 25 16:37 Traffic05.dmp
-rw-r--r--. 1 root root 117855276 Mar 25 16:39 Traffic06.dmp
-rw-r--r--. 1 root root 109911288 Mar 25 16:40 Traffic07.dmp
-rw-r--r--. 1 root root 121505444 Mar 25 16:42 Traffic08.dmp
-rw-r--r--. 1 root root 110303300 Mar 25 16:43 Traffic09.dmp
-rw-r--r--. 1 root root 120444026 Mar 25 16:45 Traffic10.dmp
-rw-r--r--. 1 root root 98545664 Mar 25 16:46 Traffic11.dmp
-rw-r--r--. 1 root root 0 Mar 25 16:48 Traffic12.dmp
-rw-r--r--. 1 root root 0 Mar 25 16:50 Traffic13.dmp
-rw-r--r--. 1 root root 0 Mar 25 16:51 Traffic14.dmp
-rw-r--r--. 1 root root 0 Mar 25 16:53 Traffic15.dmp
-rw-r--r--. 1 root root 0 Mar 25 16:54 Traffic16.dmp
...
有时它有效,有时它没有。以前有人遇到过这种问题吗?非常感谢你帮助我。