如何在tcpdump输出stream中显示接口？

我希望有人对解决这个问题感兴趣。 ;）我们公司有同样的问题，我开始为此写一个脚本。

我用源代码和屏幕截图写了一篇关于它的博客文章 。

我也在下面分享了…

和代码:(请务必检查我的网站以便将来更新）

 #!/bin/bash #=================================================================================== # # FILE: dump.sh # USAGE: dump.sh [-i interface] [tcpdump-parameters] # DESCRIPTION: tcpdump on any interface and add the prefix [Interace:xy] in front of the dump data. # OPTIONS: same as tcpdump # REQUIREMENTS: tcpdump, sed, ifconfig, kill, awk, grep, posix regex matching # BUGS: --- # FIXED: - In 1.0 The parameter -w would not work without -i parameter as multiple tcpdumps are started. # - In 1.1 VLAN's would not be shown if a single interface was dumped. # NOTES: --- # - 1.2 git initial # AUTHOR: Sebastian Haas # COMPANY: pharma mall # VERSION: 1.2 # CREATED: 16.09.2014 # REVISION: 22.09.2014 # #=================================================================================== # When this exits, exit all background processes: trap 'kill $(jobs -p) &> /dev/null && sleep 0.2 && echo ' EXIT # Create one tcpdump output per interface and add an identifier to the beginning of each line: if [[ $@ =~ -i[[:space:]]?[^[:space:]]+ ]]; then tcpdump -l $@ | sed 's/^/[Interface:'"${BASH_REMATCH[0]:2}"'] /' & else for interface in $(ifconfig | grep '^[a-z0-9]' | awk '{print $1}') do tcpdump -l -i $interface -nn $@ | sed 's/^/[Interface:'"$interface"'] /' & done fi # wait .. until CTRL+C wait 

您可以使用-e选项来打印以太网报头，然后您可以将src / dst MAC地址与您的networking接口相关联;）。

我也不知道有什么答案。 我找不到任何选项，不能回想起来看到一个，而且更确定tcpdump格式不包含接口标识符。 我想你将不得不为每个接口启动一个tcpdump实例并logging到相应的文件。

假设这是在Linux上，你可以添加一个iptables规则来匹配你正在查找的数据包并logging下来。 Iptables日志包括入口和出口接口等等。

 for interface in `ifconfig | grep '^[a-z0-9]' | awk '{print $1}'`;do echo $interface;tcpdump -i $interface -nn -c 25;done 

根据需要调整-c。

如果您在Mac上运行，那么如果使用的是pktap接口，则会有tcpdump的-k选项，该接口会将接口名称转储到其他有用的元数据中。

  -k Control the display of packet metadata via an optional metadata_arg argument. This is useful when displaying packet saved in the pcap-ng file format or with interfaces that support the PKTAP data link type. By default, when the metadata_arg optional argument is not specified, any available packet metadata information is printed out. The metadata_arg argument controls the display of specific packet metadata information using a flag word, where each character corresponds to a type of packet metadata as follows: I interface name (or interface ID) N process name P process ID S service class D direction C comment U process UUID (not shown by default) A display all types of metadata This is an Apple modification.