테스트 사이트 - 개발 중인 베타 버전입니다

ngrep 설치 및 사용하기

· 13년 전 · 1878
 # ngrep 설치
 
wget http://prdownloads.sf.net/ngrep/ngrep-1.43.tar.bz2
bunzip2 ngrep-1.43.tar.bz2
tar xvfp ngrep-1.43.tar
cd ngrep-1.43
* gcc 가 없다면 설치
yum -y install gcc
* pcap 
yum -y install libpcap-devel
./configure
make
 
 
# 사용방법
 
usage: ngrep <-hXViwqpevxlDtTRM> <-IO pcap_dump> <-n num> <-d dev> <-A num>
             <-s snaplen> <-S limitlen> <-W normal|byline|none> <-c cols>
             <-P char> <-F file> <match expression> <bpf filter>
   -h  is help/usage
   -V  is version information
   -q  is be quiet (don't print packet reception hash marks)
   -e  is show empty packets
   -i  is ignore case
   -v  is invert match
   -R  is don't do privilege revocation logic
   -x  is print in alternate hexdump format
   -X  is interpret match expression as hexadecimal
   -w  is word-regex (expression must match as a word)
   -p  is don't go into promiscuous mode
   -l  is make stdout line buffered
   -D  is replay pcap_dumps with their recorded time intervals
   -t  is print timestamp every time a packet is matched
   -T  is print delta timestamp every time a packet is matched
   -M  is don't do multi-line match (do single-line match instead)
   -I  is read packet stream from pcap format file pcap_dump
   -O  is dump matched packets in pcap format to pcap_dump
   -n  is look at only num packets
   -A  is dump num packets after a match
   -s  is set the bpf caplen
   -S  is set the limitlen on matched packets
   -W  is set the dump format (normal, byline, none)
   -c  is force the column width to the specified size
   -P  is set the non-printable display char to what is specified
   -F  is read the bpf filter from the specified file
   -d  is use specified device instead of the pcap default
 
 
./ngrep -t port 80
 
 
[root@www ngrep-1.43]# ./ngrep -t port 80
interface: eth0 (211.x.x.x/255.255.255.128)
filter: ip and ( port 80 )
####
T 2011/09/16 10:57:18.288304 x.x.x.x:50815 -> x.x.x.x:80 [AP]
  GET / HTTP/1.1..Accept: */*..Accept-Language: ko-KR..User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.1; chromeframe/13.0.782.220; SLCC2; .NET
   CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)..Accept-Encoding: gzip, deflate..Host: x.x.x.x.Connection: Keep-Alive....     
##
...중략

댓글 작성

댓글을 작성하시려면 로그인이 필요합니다.

로그인하기

게시글 목록

번호 제목
12386
12385
12384
12380
12379
12378
12377
12376
12375
12374
12373
12372
12371
12369
368
12368
12367
12366
12365
12363
12362
12361
12360
12359
12358