traffic-analysis
installsforks
How to install traffic-analysis?
chaterm/terminal-skills/traffic-analysis
$npx -y skills add chaterm/terminal-skills --skill traffic-analysis流量分析与抓包
SKILL.md
| 1 | # 流量分析与抓包 |
| 2 | |
| 3 | ## 概述 |
| 4 | tcpdump、Wireshark、流量分析与网络诊断技能。 |
| 5 | |
| 6 | ## tcpdump |
| 7 | |
| 8 | ### 基础用法 |
| 9 | ```bash |
| 10 | # 监听所有接口 |
| 11 | tcpdump -i any |
| 12 | |
| 13 | # 指定接口 |
| 14 | tcpdump -i eth0 |
| 15 | |
| 16 | # 详细输出 |
| 17 | tcpdump -v |
| 18 | tcpdump -vv |
| 19 | tcpdump -vvv |
| 20 | |
| 21 | # 显示 ASCII |
| 22 | tcpdump -A |
| 23 | |
| 24 | # 显示十六进制 |
| 25 | tcpdump -X |
| 26 | tcpdump -XX |
| 27 | |
| 28 | # 不解析主机名 |
| 29 | tcpdump -n |
| 30 | |
| 31 | # 不解析端口名 |
| 32 | tcpdump -nn |
| 33 | ``` |
| 34 | |
| 35 | ### 过滤表达式 |
| 36 | ```bash |
| 37 | # 主机过滤 |
| 38 | tcpdump host 192.168.1.100 |
| 39 | tcpdump src host 192.168.1.100 |
| 40 | tcpdump dst host 192.168.1.100 |
| 41 | |
| 42 | # 网段过滤 |
| 43 | tcpdump net 192.168.1.0/24 |
| 44 | |
| 45 | # 端口过滤 |
| 46 | tcpdump port 80 |
| 47 | tcpdump src port 80 |
| 48 | tcpdump dst port 443 |
| 49 | tcpdump portrange 8000-9000 |
| 50 | |
| 51 | # 协议过滤 |
| 52 | tcpdump tcp |
| 53 | tcpdump udp |
| 54 | tcpdump icmp |
| 55 | tcpdump arp |
| 56 | |
| 57 | # 组合过滤 |
| 58 | tcpdump 'host 192.168.1.100 and port 80' |
| 59 | tcpdump 'src 192.168.1.100 and dst port 443' |
| 60 | tcpdump 'tcp and (port 80 or port 443)' |
| 61 | tcpdump 'not port 22' |
| 62 | ``` |
| 63 | |
| 64 | ### 保存与读取 |
| 65 | ```bash |
| 66 | # 保存到文件 |
| 67 | tcpdump -w capture.pcap |
| 68 | tcpdump -w capture.pcap -c 1000 # 限制包数 |
| 69 | |
| 70 | # 读取文件 |
| 71 | tcpdump -r capture.pcap |
| 72 | tcpdump -r capture.pcap -nn |
| 73 | |
| 74 | # 轮转文件 |
| 75 | tcpdump -w capture-%H%M%S.pcap -G 3600 # 每小时 |
| 76 | tcpdump -w capture.pcap -C 100 # 每 100MB |
| 77 | ``` |
| 78 | |
| 79 | ### 高级过滤 |
| 80 | ```bash |
| 81 | # TCP 标志 |
| 82 | tcpdump 'tcp[tcpflags] & tcp-syn != 0' |
| 83 | tcpdump 'tcp[tcpflags] & tcp-rst != 0' |
| 84 | tcpdump 'tcp[tcpflags] == tcp-syn' |
| 85 | |
| 86 | # HTTP 请求 |
| 87 | tcpdump -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' |
| 88 | |
| 89 | # DNS 查询 |
| 90 | tcpdump -i any 'udp port 53' |
| 91 | |
| 92 | # 大包 |
| 93 | tcpdump 'greater 1000' |
| 94 | tcpdump 'less 100' |
| 95 | ``` |
| 96 | |
| 97 | ## tshark (Wireshark CLI) |
| 98 | |
| 99 | ### 基础用法 |
| 100 | ```bash |
| 101 | # 安装 |
| 102 | apt install tshark |
| 103 | |
| 104 | # 监听 |
| 105 | tshark -i eth0 |
| 106 | |
| 107 | # 指定过滤器 |
| 108 | tshark -i eth0 -f "port 80" |
| 109 | |
| 110 | # 显示过滤器 |
| 111 | tshark -i eth0 -Y "http" |
| 112 | ``` |
| 113 | |
| 114 | ### 字段提取 |
| 115 | ```bash |
| 116 | # 提取特定字段 |
| 117 | tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port |
| 118 | |
| 119 | # HTTP 请求 |
| 120 | tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri |
| 121 | |
| 122 | # DNS 查询 |
| 123 | tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name |
| 124 | ``` |
| 125 | |
| 126 | ### 统计分析 |
| 127 | ```bash |
| 128 | # 协议统计 |
| 129 | tshark -r capture.pcap -q -z io,phs |
| 130 | |
| 131 | # 会话统计 |
| 132 | tshark -r capture.pcap -q -z conv,tcp |
| 133 | |
| 134 | # HTTP 统计 |
| 135 | tshark -r capture.pcap -q -z http,tree |
| 136 | |
| 137 | # 端点统计 |
| 138 | tshark -r capture.pcap -q -z endpoints,ip |
| 139 | ``` |
| 140 | |
| 141 | ## ngrep |
| 142 | |
| 143 | ### 基础用法 |
| 144 | ```bash |
| 145 | # 安装 |
| 146 | apt install ngrep |
| 147 | |
| 148 | # 搜索内容 |
| 149 | ngrep -q 'GET' port 80 |
| 150 | ngrep -q 'password' port 80 |
| 151 | |
| 152 | # 指定接口 |
| 153 | ngrep -d eth0 'pattern' |
| 154 | |
| 155 | # 忽略大小写 |
| 156 | ngrep -qi 'error' |
| 157 | ``` |
| 158 | |
| 159 | ## iftop / nethogs |
| 160 | |
| 161 | ### iftop |
| 162 | ```bash |
| 163 | # 安装 |
| 164 | apt install iftop |
| 165 | |
| 166 | # 基础用法 |
| 167 | iftop |
| 168 | iftop -i eth0 |
| 169 | |
| 170 | # 不解析主机名 |
| 171 | iftop -n |
| 172 | |
| 173 | # 显示端口 |
| 174 | iftop -P |
| 175 | |
| 176 | # 过滤 |
| 177 | iftop -f "dst port 80" |
| 178 | ``` |
| 179 | |
| 180 | ### nethogs |
| 181 | ```bash |
| 182 | # 安装 |
| 183 | apt install nethogs |
| 184 | |
| 185 | # 按进程显示 |
| 186 | nethogs |
| 187 | nethogs eth0 |
| 188 | |
| 189 | # 刷新间隔 |
| 190 | nethogs -d 2 |
| 191 | ``` |
| 192 | |
| 193 | ## 常见场景 |
| 194 | |
| 195 | ### 场景 1：HTTP 流量分析 |
| 196 | ```bash |
| 197 | # 抓取 HTTP 请求 |
| 198 | tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' |
| 199 | |
| 200 | # 提取 HTTP 头 |
| 201 | tcpdump -i any -A 'tcp port 80' | grep -E "^(GET|POST|HTTP|Host:|Content-)" |
| 202 | |
| 203 | # tshark 分析 |
| 204 | tshark -i any -Y "http.request" -T fields -e http.host -e http.request.method -e http.request.uri |
| 205 | ``` |
| 206 | |
| 207 | ### 场景 2：DNS 问题排查 |
| 208 | ```bash |
| 209 | # 抓取 DNS |
| 210 | tcpdump -i any -nn port 53 |
| 211 | |
| 212 | # 详细 DNS 信息 |
| 213 | tcpdump -i any -vvv port 53 |
| 214 | |
| 215 | # tshark DNS 分析 |
| 216 | tshark -i any -Y "dns" -T fields -e dns.qry.name -e dns.a |
| 217 | ``` |
| 218 | |
| 219 | ### 场景 3：连接问题诊断 |
| 220 | ```bash |
| 221 | # TCP 握手 |
| 222 | tcpdump -i any 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0' |
| 223 | |
| 224 | # 重传 |
| 225 | tcpdump -i any 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack != 0' |
| 226 | |
| 227 | # 连接重置 |
| 228 | tcpdump -i any 'tcp[tcpflags] & tcp-rst != 0' |
| 229 | ``` |
| 230 | |
| 231 | ### 场景 4：带宽分析 |
| 232 | ```bash |
| 233 | # 实时带宽 |
| 234 | iftop -i eth0 -P -n |
| 235 | |
| 236 | # 按进程 |
| 237 | nethogs eth0 |
| 238 | |
| 239 | # 统计流量 |
| 240 | tcpdump -i eth0 -w - | pv > /dev/null |
| 241 | ``` |
| 242 | |
| 243 | ## 故障排查 |
| 244 | |
| 245 | | 问题 | 排查方法 | |
| 246 | |------|----------| |
| 247 | | 丢包 | 检查 tcpdump 统计、网卡队列 | |
| 248 | | 延迟高 | 分析 RTT、重传 | |
| 249 | | 连接失败 | 检查 SYN/RST 包 | |
| 250 | | 带宽占用 | 使用 iftop/nethogs | |
| 251 | |
| 252 | ```bash |
| 253 | # 查看丢包 |
| 254 | tcpdump -i eth0 -w /dev/null 2>&1 | grep -i drop |
| 255 | |
| 256 | # 网卡统计 |
| 257 | ethtool -S eth0 | grep -i error |
| 258 | cat /proc/net/dev |
| 259 | |
| 260 | # 连接状态 |
| 261 | ss -s |
| 262 | netstat -s | grep -i retrans |
| 263 | ``` |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
