在tcpdump我们长期是针对host,port和协议这些来进行抓包。但是如果我们想过滤某个进程发出的数据进行抓包,那也许只能先全部抓,然后再用wireshark打开进行过滤分析。
不过现在有个ptcpdump工具,这个是直接可以针对进程和pid进行抓包。
https://github.com/mozillazg/ptcpdump
下面我就在rocky8上进行测试一下可以使用。
1 2 3 4 5 6 7 8 9 10 11 12 13
| [timo@rocky8-1-test ~]$ sudo ./ptcpdump -i any --pname curl -w demo.pcapng 2024-07-16 09:48:06 WARN skip Docker Engine integration 2024-07-16 09:48:11 WARN skip containerd integration 2024-07-16 09:48:11 WARN skip kubernetes integration 2024-07-16 09:48:11 WARN skip attach cgroup due to get cgroup v2 root dir failed: cgroupv2 is not mounted 2024-07-16 09:48:11 WARN current system doest not enable netfilter based NAT feature, skip attach kprobe/nf_nat_packet 2024-07-16 09:48:11 WARN current system doest not enable netfilter based NAT feature, skip attach kprobe/nf_nat_manip_pkt 2024-07-16 09:48:11 WARN ptcpdump: verbose output suppressed, use -v[v]... for verbose output 2024-07-16 09:48:11 WARN capturing on any, link-type EN10MB (Ethernet), snapshot length 262144 bytes ^C 20 packets captured 20 packets received by filter 0 packets dropped by kernel
|
开启这个之后我又开了一个窗口进行curl
1 2 3
| [timo@rocky8-1-test ~]$ curl www.baidu.com <!DOCTYPE html> <!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>百度一下,你就知道</title></head> <body link=
|
用wireshark打开还行,确实是我curl的一个流程,把dns解析,tcp握手这些都给包含了。不过使用上应该对于kernel的版本是有要求的。 4.10 < kernel < 5.2 应该都可以正常使用的。其他的就不知道了。
![](https://images.timoq.com/2024/07/wireshark.jpg)