tcpdump -nnee -i eth1 -c 10
tcpdump -nn -vvv -i en0 -s 1500 -c 1 'ether[20:2] == 0x2000
[root@blackpc ~]# tcpdump -i eth1 -n -c 300 "broadcast or multicast"
Применяем фильтры (в зависимости от версии Wireshark):
Далее в отфильтрованном смотрим на поле “Server Name:”.
Путь:
Secure Sockets Layer –>
TLS Record Layer –>
Handshake Protocol: Client Hello –>
Extension: server_name –>
Server Name Indication extension –>
Server Name: xakep.ru
Используем ssl.handshake.extension.data contains “xakep.ru” когда надо отфильтровать пакеты с определенным SNI.
tcpdump -i eth1 -s 1500 -X '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)'
Пример:
[root@blackpc ~]# tcpdump -i eth1 -s 1500 -X '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01)' and '(tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' and host 178.248.232.27 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 1500 bytes 14:44:29.950497 IP x.x.x.x.60044 > 178.248.232.27.https: Flags [P.], seq 2690445558:2690446075, ack 2960121525, win 115, options [nop,nop,TS val 100379054 ecr 1195184343], length 517 0x0000: 4500 0239 5960 4000 4006 769e c0a8 0d04 E..9Y`@.@.v..... 0x0010: b2f8 e81b ea8c 01bb a05c f0f6 b06f deb5 .........\...o.. 0x0020: 8018 0073 6aec 0000 0101 080a 05fb a9ae ...sj........... 0x0030: 473d 10d7 1603 0102 0001 0001 fc03 0347 G=.............G 0x0040: edab 33fe a68e 1625 904e 404c d99c dc12 ..3....%.N@L.... 0x0050: 645e de6e f35f d2a3 5fe4 920a 51a6 8820 d^.n._.._...Q... 0x0060: cf3b 1e81 07e6 a15c 5343 fb04 3e7e a684 .;.....\SC..>~.. 0x0070: ba9e 5fd3 5ad5 fcf6 5969 21a2 0035 bdbe .._.Z...Yi!..5.. 0x0080: 0024 c02b c02f 009e c00a c009 c013 c014 .$.+./.......... 0x0090: c007 c011 0033 0032 0039 009c 002f 0035 .....3.2.9.../.5 0x00a0: 000a 0005 0004 0100 018f 0000 000d 000b ................ 0x00b0: 0000 0878 616b 6570 2e72 75ff 0100 0100 ...xakep.ru..... 0x00c0: 000a 0008 0006 0017 0018 0019 000b 0002 ................ 0x00d0: 0100 0023 00b0 8aec 9689 2d9d 7387 24ef ...#......-.s.$. 0x00e0: 1c8d e0b6 08ce 283b c5a7 174b 09cd 43db ......(;...K..C. 0x00f0: 87e3 3d9d f4ff 6cc8 c327 a9d3 9537 8e29 ..=...l..'...7.) 0x0100: 637f 7f7d e146 401c 84c5 b62d 38f6 284c c..}.F@....-8.(L 0x0110: 656a d3ab c460 77c2 d024 2b09 cf7c 94ca ej...`w..$+..|.. 0x0120: a603 e410 38c9 4154 8ed5 4e67 b871 60ee ....8.AT..Ng.q`. 0x0130: 7ad0 e003 ccf4 dd49 67cf 32e8 881d 740d z......Ig.2...t. 0x0140: 5ebc 99f3 d08a cf2c f24a 0a28 b5ea 3157 ^......,.J.(..1W 0x0150: 78fb c9f0 f2ef 87aa bdb2 822c 1c61 d47c x..........,.a.| 0x0160: 68b7 b55c 0440 bf26 47f5 d5df acbf 6b3e h..\.@.&G.....k> 0x0170: d45d 7dc1 dd72 0abb abb2 183d 88a1 9237 .]}..r.....=...7 0x0180: 4cc4 9bfa 70ed 3374 0000 0010 001a 0018 L...p.3t........ 0x0190: 0873 7064 792f 332e 3105 6832 2d31 3408 .spdy/3.1.h2-14. 0x01a0: 6874 7470 2f31 2e31 0005 0005 0100 0000 http/1.1........ 0x01b0: 0000 1200 0000 0d00 1200 1004 0105 0102 ................ 0x01c0: 0104 0305 0302 0304 0202 0200 1500 6a00 ..............j. 0x01d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x01e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x01f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0200: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0220: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0230: 0000 0000 0000 0000 00 .........