tcpdump 常用命令

监听 8080 GET POST 报文和结果

tcpdump -i any -s0 -A 'tcp port 8080 and (  (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420 or   tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354 or tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450) )'