Ubuntu 下使用抓包工具定位网络故障的实用流程
一、准备与工具选择
sudo apt-get update && sudo apt-get install -y tcpdump wiresharksudo usermod -aG wireshark $USER,然后重新登录以生效(Wireshark 将使用 dumpcap 以最小权限抓包)。二、快速定位流程
eth0、ens*、wlan0)。sudo tcpdump -i eth0 -nn -c 50 'tcp or udp or icmp'sudo tcpdump -i eth0 -nn host 10.0.0.10 and port 443sudo tcpdump -i eth0 -w issue.pcap 'tcp port 443'sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'sudo tcpdump -i eth0 -nn udp or tcp port 53sudo tcpdump -i eth0 -nn 'tcp port 80 or 443'sudo tcpdump -i eth0 -nn icmptcpdump -r issue.pcap -nn -vvtcp.port == 443、dns)定位异常点。三、无线与加密流量的定位要点
sudo systemctl stop NetworkManager && sudo systemctl stop wpa_supplicantiw devsudo ip link set <iface> down && sudo iw dev <iface> set type monitor && sudo ip link set <iface> upsudo iw dev <iface> set channel <信道号>wlan.fc.type_subtype == 0x08(Beacon)、eapol(握手)。sudo ip link set <iface> down && sudo iw dev <iface> set type managed && sudo ip link set <iface> up && sudo systemctl start NetworkManager && sudo systemctl start wpa_supplicant四、高效过滤表达式速查
host 192.168.1.10port 443host 10.0.0.5 and port 22'tcp[tcpflags] & (tcp-syn) != 0 and tcp[tcpflags] & (tcp-ack) == 0'udp or tcp port 53icmp'tcp port 80 or 443' and host 203.0.113.10-w file.pcap / -r file.pcap-n;更详细输出:-v/-vv/-vvv。五、排错与合规建议