使用以太网标头了解 tcpdump 跟踪
我的 tcpdump 日志中有两个数据包，我不知道第二列中的“P”和“In”是什么意思。有人可以解释一下它们的意思吗？
00:43:44.896482 P 00:00:ac:12:80:01 ethertype IPv4 (0x0800), length 76: 172.18.128.1.ssh > 155.xx.xx.xx.56365: S 1308033114:1308033114(0) ack 1315850475 win 5792 <mss 1460,sackOK,timestamp 12196173 122040733,nop,wscale 8>
00:43:44.896482 In 00:00:ac:12:80:01 ethertype IPv4 (0x0800), length 76: 172.18.128.1.ssh > 155.yy.yy.yy.4242: S 1308033114:1308033114(0) ack 1315850475 win 5792 <mss 1460,sackOK,timestamp 12196173 122040733,nop,wscale 8>
请注意，目标 IP 会因为这个“P”而发生变化。
I have two packets in my tcpdump log and I have no idea what "P" and "In" in the second column mean. Could someone explain what they mean?
00:43:44.896482 P 00:00:ac:12:80:01 ethertype IPv4 (0x0800), length 76: 172.18.128.1.ssh > 155.xx.xx.xx.56365: S 1308033114:1308033114(0) ack 1315850475 win 5792 <mss 1460,sackOK,timestamp 12196173 122040733,nop,wscale 8>
00:43:44.896482 In 00:00:ac:12:80:01 ethertype IPv4 (0x0800), length 76: 172.18.128.1.ssh > 155.yy.yy.yy.4242: S 1308033114:1308033114(0) ack 1315850475 win 5792 <mss 1460,sackOK,timestamp 12196173 122040733,nop,wscale 8>
Note that the dest IP changes because of this "P" thing.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
从 Guy Harris 的 tcpdump-workers 邮件列表中得到以下答案。
Linux“any”设备使用 DLT_LINUX_SLL/LINKTYPE_LINUX_SLL 链路层标头，其中包括从 PF_PACKET 套接字上的“recvfrom()”调用获得的信息，其中包括数据包的源地址，但不包括目标地址，因此您看到的唯一链路层地址是源地址。
它还包括一些指示数据包如何接收的标志：
“In” - 数据包单播到主机；
“B” - 数据包被广播；
“M” - 数据包未广播，但进行了多播；
“P” - 数据包被单播到某个其他主机，并且该主机收到它，因为网络适配器处于混杂模式；
“Out” - 数据包由主机发送并“环绕”并传递到 PF_PACKET 套接字。
我认为，Linux 网络堆栈确定“In”、“B”、“M”和“P”之间差异的方式是通过查看数据包的目标地址并查看它是否是广播地址（ff： ff:ff:ff:ff:ff（在使用 IEEE MAC-48 地址的网络上）、多播地址（在使用 IEEE MAC-48 地址的网络上设置了“组”位）或其所在适配器的地址已收到。有点令人惊讶的是，它在“任何”设备上检测到混杂接收的数据包，因为“任何”设备本身无法进入混杂模式，但可能是该设备所在的特定接口由于某些其他原因，收到的数据包处于混杂模式。
Got the following answer from the tcpdump-workers mailing list from Guy Harris.
The Linux "any" device uses the DLT_LINUX_SLL/LINKTYPE_LINUX_SLL link-layer header, which includes information you get from a "recvfrom()" call on a PF_PACKET socket, which includes the source address, but not the destination address, of the packet, so the only link-layer address you see is the source address.
It also includes some flags that indicate how the packet was received:
"In" - the packet was unicast to the host;
"B" - the packet was broadcast;
"M" - the packet wasn't broadcast but was multicast;
"P" - the packet was unicast to some other host and this host received it because the network adapter was in promiscuous mode;
"Out" - the packet was sent by the host and "wrapped around" and delivered to the PF_PACKET socket.
The way the Linux networking stack determines the difference between "In", "B", "M", and "P" is, I think, by looking at the destination address of the packet and seeing whether it's a broadcast address (ff:ff:ff:ff:ff:ff on networks using IEEE MAC-48 addresses), a multicast address (has the "group" bit set, on networks using IEEE MAC-48 addresses), or the address of the adapter on which it's received. It's a bit surprising that it detected a promiscuously-received packet on the "any" device, as the "any" device itself can't be put into promiscuous mode, but perhaps the particular interface from which that packet was received was in promiscuous mode for some other reason.