linux snoop抓包命令,Bash脚本实现Solaris/Linux自动抓包功能

港控/mmm° 2023-01-22 15:57 486阅读 0赞

咱们的产品OS有Solaris和Linux两种， 故障定位时常常须要现场的同窗抓包。 为了方便抓包， 用shell作了一个抓包脚本。shell

主要功能以下：session

一、自动识别OS类型， 使用对应的抓包命令， Solaris是snoop命令， Linux是tcpdump命令；tcp

二、提示方式输入网卡、IP地址和端口；工具

三、可支持实时抓包和后台定时抓包(15分钟生成一个抓包文件)两种模式。oop

贴出完整代码， 若是这个工具对你有用， 请记得点赞！ui

\#!/bin/sh

\#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

\# A tool to capture TCP/IP packets automatically

\# Author: Gary Li

\# E-mail: Gang.H.LI@nokia-sbell.com

\#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

OS=\`uname\`

PCAP\_CMD=""

PARA\_I=""

PARA\_F=""

GZIP=""

PING\_CMD=""

PARA\_H=""

NICS=""

if \[ "$OS" = "SunOS" \]; then

PCAP\_CMD="/usr/sbin/snoop"

PARA\_I="-d"

PARA\_F="-o"

GZIP="/usr/bin/gzip"

PING\_CMD="/usr/sbin/ping"

IFCONFIG\_CMD="/usr/sbin/ifconfig"

NICS=\`$IFCONFIG\_CMD -a|grep -v lo0|grep flags|cut -f1 -d:\`

elif \[ "$OS" = "Linux" \]; then

PCAP\_CMD="/usr/sbin/tcpdump"

PARA\_I="-i"

PARA\_F="-w"

GZIP="/bin/gzip"

PING\_CMD="/bin/ping -c 1"

PARA\_H="host"

IFCONFIG\_CMD="/sbin/ifconfig"

NICS=\`$IFCONFIG\_CMD -a|grep ' Link encap:Ethernet'|awk '\{print $1\}'\`

else

echo "Wrong OS type."

exit 1

echo $0 | grep '^\\.' >/dev/null 2>&1

if \[ "$?" = "0" \]; then

CMD=\`pwd\`/$0

CMD=\`echo $CMD | sed 's/\\.\\///'\`

else

CMD=$0

BINDIR=\`dirname $CMD\`

AskNicName() \{

NIC="notValidInput"

while \[ "$NIC" = "notValidInput" \]; do

echo "Please select NIC from below list then press Enter."

echo $NICS

echo "Press Enter directly for any: "

read ANS

if \[ "$ANS" = "q" \] || \[ "$ANS" = "Q" \] || \[ "$ANS" = "quit" \] || \[ "$ANS" = "exit" \]; then

exit 0

if \[ "X$ANS" = "X" \]; then

NIC="any"

if \[ "$OS" = "SunOS" \]; then

echo "Not support any by snoop."

NIC="notValidInput"

else

$IFCONFIG\_CMD $ANS >/dev/null 2>&1

if \[ "$?" = "0" \]; then

NIC=$ANS

else

echo "Input is not valid. Please retry. "

NIC="notValidInput"

done

AskIPAddr() \{

IPADDR="notValidInput"

while \[ "$IPADDR" = "notValidInput" \]; do

echo "Please input IP Address (Default is none): "

read ANS

if \[ "$ANS" = "q" \] || \[ "$ANS" = "Q" \] || \[ "$ANS" = "quit" \] || \[ "$ANS" = "exit" \]; then

exit 0

if \[ "X$ANS" = "X" \] || \[ "$ANS" = "NONE" \] || \[ "$ANS" = "none" \]; then

IPADDR=""

else

\#$PING\_CMD $ANS >/dev/null 2>&1

CHK\_RES=\`ValidIPAddr $ANS\`

if \[ "$CHK\_RES" = "valid" \]; then

IPADDR="$PARA\_H $ANS"

else

echo "Input is not valid. Please retry. "

IPADDR="notValidInput"

done

ValidIPAddr() \{

if echo "$1" | \{ IFS=. read a b c d e;

test "$a" -ge 0 2>/dev/null && test "$a" -le 255 2>/dev/null &&

test "$b" -ge 0 2>/dev/null && test "$b" -le 255 2>/dev/null &&

test "$c" -ge 0 2>/dev/null && test "$c" -le 255 2>/dev/null &&

test "$d" -ge 0 2>/dev/null && test "$d" -le 255 2>/dev/null &&

test -z "$e" 2>/dev/null; \}; then

echo valid

else

echo invalid

AskPortNum() \{

PORT="notValidInput"

while \[ "$PORT" = "notValidInput" \]; do

echo "Please input Port (Default is none): "

read ANS

if \[ "$ANS" = "q" \] || \[ "$ANS" = "Q" \] || \[ "$ANS" = "quit" \] || \[ "$ANS" = "exit" \]; then

exit 0

if \[ "X$ANS" = "X" \] || \[ "$ANS" = "NONE" \] || \[ "$ANS" = "none" \]; then

PORT=""

else

if \[ $ANS -eq $ANS \] 2>/dev/null; then

if \[ "x$IPADDR" = "x" \]; then

PORT="port "$ANS

else

PORT="and port "$ANS

else

echo "Input is not valid. Please retry. "

PORT="notValidInput"

done

AddIntoCron() \{

TASK\_15MIN="0,15,30,45 0-23 \* \* \* $CMD $PARA\_I $NIC $IPADDR $PORT > $BINDIR/output.log 2>&1"

DumpOldCron

echo "$TASK\_15MIN" >> /var/tmp/mycron.new

crontab /var/tmp/mycron.new

CleanTmpFile

echo "Enabled."

DisableCron() \{

DumpOldCron

crontab /var/tmp/mycron.new

CleanTmpFile

CloseExistProcess

echo "Disabled."

DumpOldCron() \{

touch /var/tmp/mycron.old

crontab -l > /var/tmp/mycron.old 2>/dev/null

grep -v "$CMD" /var/tmp/mycron.old > /var/tmp/mycron.new 2>/dev/null

CleanTmpFile() \{

rm -f /var/tmp/mycron.new

rm -f /var/tmp/mycron.old

CloseExistProcess() \{

if \[ \`ps -ef|grep -v grep|grep "$PCAP\_CMD"|grep "AUTOPCAP"|wc -l\` -gt 0 \]; then

ps -ef|grep -v grep|grep "$PCAP\_CMD"|grep "AUTOPCAP"|awk '\{print $2\}'|xargs kill -INT >/dev/null 2>&1

StartPcap() \{

DT=\`date '+%Y-%m-%d-%H-%M-%S'\`

FN=$BINDIR"/AUTOPCAP\_"$DT".pcap"

if \[ "$1" = "$PARA\_I" \]; then

NIC=$2

if \[ "$NIC" != "any" \]; then

$IFCONFIG\_CMD $NIC >/dev/null 2>&1

if \[ "$?" != "0" \]; then

echo $NIC" is not a valid NIC."

exit 1

CloseExistProcess

echo "Start to capture packets on "$NIC" into file "$FN

echo "Press Ctrl+c to stop this session."

$PCAP\_CMD $PARA\_F $FN $\* >/dev/null 2>&1

\#$PCAP\_CMD $PARA\_F $FN $PARA\_I $NIC $IPADDR $PORT >/dev/null 2>&1

$GZIP $FN >/dev/null 2>&1

\#\#\#\#\# Main \#\#\#\#\#

if \[ $\# -ge 1 \]; then

if \[ "$1" = "enable" \]; then

AskNicName

AskIPAddr

AskPortNum

AddIntoCron

elif \[ "$1" = "disable" \]; then

DisableCron

else

if \[ "$1" = "$PARA\_I" \]; then

NIC=$2

StartPcap $\*

elif \[ "$1" = "-h" \] || \[ "$1" = "-H" \]; then

echo "Usage:"

echo "./autopcap.sh -- no argument means to capture now"

echo "./autopcap.sh \[enable|disable\] -- enable or disable capturing in background. Generate a file per 15 min"

echo ""

exit 0

else

echo "Wrong arguments."

exit 1

else

AskNicName

AskIPAddr

AskPortNum

StartPcap $PARA\_I $NIC $IPADDR $PORT

exit 0

linux snoop抓包命令,Bash脚本实现Solaris/Linux自动抓包功能

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关抓包，反抓包，反反抓包

相关 Linux tcpdump抓包

相关 Linux抓包

相关 tcpdump抓包命令

相关 tcpdump 抓包命令

相关 linux snoop抓包命令,Bash脚本实现Solaris/Linux自动抓包功能

相关 jmeter代理抓包进行自动录制脚本

相关 TCPdump抓包命令

相关抓包工具：tcpdump抓包命令详解

相关 Linux抓包命令