主页 / unix / 问题 / 541317
Accepted
Georgi Stoyanov
Asked: 2019-09-12 23:42:29 +0800 CST

抑制 TCPDump 输出并仅显示唯一条目

  • 772

我正在尝试执行一个tcpdump仅向我显示唯一条目的命令。这是我的命令和输出：

$ sudo tcpdump -c 5 -q -i eno1 -nn -vvv tcp | sort | uniq
tcpdump: listening on br1, link-type EN10MB (Ethernet), capture size 262144 bytes
5 packets captured
6 packets received by filter
0 packets dropped by kernel
09:39:51.350138 IP (tos 0x10, ttl 64, id 61352, offset 0, flags [DF], proto TCP (6), length 184)
09:39:51.350743 IP (tos 0x0, ttl 124, id 3896, offset 0, flags [DF], proto TCP (6), length 40)
09:39:51.811811 IP (tos 0x0, ttl 124, id 3901, offset 0, flags [DF], proto TCP (6), length 92)
09:39:51.811861 IP (tos 0x0, ttl 64, id 41613, offset 0, flags [DF], proto TCP (6), length 40)
09:39:52.424473 IP (tos 0x0, ttl 64, id 41614, offset 0, flags [DF], proto TCP (6), length 92)
    10.184.17.196.55195 > 10.88.159.90.22: tcp 0
    10.184.17.196.58484 > 10.88.159.90.22: tcp 52
    10.88.159.90.22 > 10.184.17.196.55195: tcp 144
    10.88.159.90.22 > 10.184.17.196.58484: tcp 0
    10.88.159.90.22 > 10.184.17.196.58484: tcp 52

我希望我的输出只是唯一条目的列表并抑制正常tcpdump输出：

10.184.17.196.55195 > 10.88.159.90.22: tcp 0
10.184.17.196.58484 > 10.88.159.90.22: tcp 52
10.88.159.90.22 > 10.184.17.196.55195: tcp 144
10.88.159.90.22 > 10.184.17.196.58484: tcp 0
10.88.159.90.22 > 10.184.17.196.58484: tcp 52
networking

1 个回答

  1. Best Answer

    您是否考虑过添加一个简单的 grep 命令作为额外的管道？例如，

    $ sudo tcpdump -c 5 -q -i eno1 -nn -vvv tcp | sort | uniq | grep '>'
    • 1

相关问题