[Shell]tcpdump抓取数据包

此例是用tcpdump抓msn信息：）

tcpdump -lnx -s 10240 dst port 1863 | gawk '{if (!~/^0x/)print ,,,,,"\n",,,,,}{if (~/^0x/) print }'
可用脚本具体分析~

tcpdump version 3.8
libpcap version 0.8.3
Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]
                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ]
                [ -y datalinktype ] [ -Z user ]
                [ expression ]

原文转自：http://www.ltesting.net