1 概述

• wireshark：全平台抓包工具，需要图形化界面，十分强大；
• httpry：http抓包插件，功能一般，操作简单；
• tcpdump：强大的抓包插件，支持多种网络协议。

2 httpry

（1）概述

• 安装：apt-get install httpry

• 操作：

  httpry [ -dFhpqs ] [ -b file ] [ -f format ] [ -i device ] [ -l threshold ]       [ -m methods ] [ -n count ] [ -o file ] [ -P file ] [ -r file ]       [ -S bytes ] [ -t seconds ] [ -u user ] [ 'expression' ]-b fileWrite all processed HTTP packets to a binary pcap dump file. Useful forfurther analysis of logged data.# 守护进程-d # 输出格式-f format# 帮助 -h# 网卡 ifconfig查看-i device# POST GET等等-m methods# 抓包数量，默认为0代表循环抓取-n count# 输出文件，不指定时直接打印-o file# 指定pid文件-P file# HTTP时间请求显示模式-s# HTTP时间请求显示模式下多少秒执行一次-t seconds# 指定linux用户-u user# filter表达式，与tcpdump相同'expression'Specify a bpf-style capture filter, overriding the default. Here are a fewbasic examples, starting with the default filter: 'tcp port 80 or 8080' 'tcp dst port 80' 'tcp dst port 80 and src host 192.168.1.1'See 'man tcpdump' for further information on the syntax and available primitives.

（2）demo

# timestamp,source-ip,dest-ip,direction,method,host,request-uri,http-version,status-code,reason-phrase> sudo httpry tcp port 80 -i lohttpry version 0.1.7 -- HTTP logging and information retrieval toolCopyright (c) 2005-2012 Jason Bittel 
    
     ----------------------------Hash buckets:       64Nodes inserted:     10Buckets in use:     10Hash collisions:    0Longest hash chain: 1----------------------------Starting capture on lo interface06/05/2006 15:32:31  192.168.0.15 66.102.7.104 > GET www.google.com / HTTP/1.1   -  -06/05/2006 15:32:31 66.102.7.104  192.168.0.15 <  -        -        - HTTP/1.1  200 OK
    

github：https://github.com/jbittel/httpry

3 tcpdump

（1）概述

• linux系统自带的抓包工具，通过命令行的方式，适合在线上服务器进行抓包操作。
• 支持针对网络层、协议、主机、网络或端口的过滤
• 可用于网络分析和问题排查的首选工具
• 操作：

tcpdump [-aAbdDefhHIJKlLnNOpqStuUvxX#] [ -B size ] [ -c count ]        [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]        [ -i interface ] [ -j tstamptype ] [ -M secret ] [ --number ]        [ -Q in|out|inout ]        [ -r file ] [ -s snaplen ] [ --time-stamp-precision precision ]        [ --immediate-mode ] [ -T type ] [ --version ] [ -V file ]        [ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]        [ -Z user ] [ expression ]

（2）demo

# 抓取lo设备 tcp协议 端口80的数据包> sudo tcpdump -n -X tcp port 80 -s 0 -i lo

注：具体使用后面再补，现在用不到这么多，学了也容易忘记，先记住它能做到的事情即可。