##常见命令
```
#tcpdump -i any src port 8081 -Xnlps0 查看8081端口流出的数据包
# tcpdump -i any dst port 8081 -Xnlps0 查看8081端口流入的数据包
```
##返回数据详情
```
这里是个websocket 连接
流出
16:10:06.395655 IP 172.16.214.145.webcache > 218.79.192.128.iccrushmore: Flags [S.], seq 3358585673, ack 3346647176, win 42340, options [mss 1460,nop,nop,sackOK,nop,wscale 14], length 0
0x0000: 4500 0034 0000 4000 4006 1d52 ac10 d691 E..4..@.@..R....
0x0010: da4f c080 1f90 1ac2 c82f f349 c779 c888 .O......./.I.y..
0x0020: 8012 a564 1d99 0000 0204 05b4 0101 0402 ...d............
0x0030: 0103 030e 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 ....
16:10:06.406882 IP 172.16.214.145.webcache > 218.79.192.128.iccrushmore: Flags [.], ack 259, win 3, length 0
0x0000: 4500 0028 f968 4000 4006 23f5 ac10 d691 E..(.h@.@.#.....
0x0010: da4f c080 1f90 1ac2 c82f f34a c779 c98a .O......./.J.y..
0x0020: 5010 0003 1d8d 0000 0000 0000 0000 0000 P...............
0x0030: 0000 0000 0000 0000 ........
16:10:06.430793 IP 172.16.214.145.webcache > 218.79.192.128.iccrushmore: Flags [P.], seq 1:185, ack 259, win 3, length 184: HTTP: HTTP/1.1 101 Switching Protocols
0x0000: 4500 00e0 f969 4000 4006 233c ac10 d691 E....i@.@.#<....
0x0010: da4f c080 1f90 1ac2 c82f f34a c779 c98a .O......./.J.y..
0x0020: 5018 0003 1e45 0000 4854 5450 2f31 2e31 P....E..HTTP/1.1
0x0030: 2031 3031 2053 7769 7463 6869 6e67 2050 .101.Switching.P
0x0040: 726f 746f 636f 6c73 0d0a 5570 6772 6164 rotocols..Upgrad
0x0050: 653a 2077 6562 736f 636b 6574 0d0a 436f e:.websocket..Co
0x0060: 6e6e 6563 7469 6f6e 3a20 5570 6772 6164 nnection:.Upgrad
0x0070: 650d 0a53 6563 2d57 6562 736f 636b 6574 e..Sec-Websocket
0x0080: 2d41 6363 6570 743a 2039 7a48 6d44 2b4c -Accept:.9zHmD+L
0x0090: 4154 4538 5665 5058 6142 765a 6170 656d ATE8VePXaBvZapem
0x00a0: 4457 3559 3d0d 0a53 6563 2d57 6562 736f DW5Y=..Sec-Webso
0x00b0: 636b 6574 2d56 6572 7369 6f6e 3a20 3133 cket-Version:.13
0x00c0: 0d0a 5365 7276 6572 3a20 7377 6f6f 6c65 ..Server:.swoole
0x00d0: 2d68 7474 702d 7365 7276 6572 0d0a 0d0a -http-server....
0x00e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
16:10:06.430934 IP 172.16.214.145.webcache > 218.79.192.128.iccrushmore: Flags [P.], seq 185:205, ack 259, win 3, length 20: HTTP
0x0000: 4500 003c f96a 4000 4006 23df ac10 d691 E..<.j@.@.#.....
0x0010: da4f c080 1f90 1ac2 c82f f402 c779 c98a .O......./...y..
0x0020: 5018 0003 1da1 0000 8112 6865 6c6c 6f2c P.........hello,
0x0030: 2077 656c 636f 6d65 2120 3a29 0000 0000 .welcome!.:)....
0x0040: 0000 0000 0000 0000 0000 0000 ............
一次websocket连接和断开
连接流入
16:35:35.267402 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [S], seq 129770545, win 8192, options [mss 1440,nop,wscale 2,nop,nop,sackOK], length 0
0x0000: 4514 0034 7625 4000 7406 7318 da4f c080 E..4v%@.t.s..O..
0x0010: ac10 d691 66e2 1f90 07bc 2431 0000 0000 ....f.....$1....
0x0020: 8002 2000 7f58 0000 0204 05a0 0103 0302 .....X..........
0x0030: 0101 0402 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 ....
16:35:35.278405 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [.], ack 95297229, win 16560, length 0
0x0000: 4514 0028 7627 4000 7406 7322 da4f c080 E..(v'@.t.s".O..
0x0010: ac10 d691 66e2 1f90 07bc 2432 05ae 1ecd ....f.....$2....
0x0020: 5010 40b0 7ad6 0000 0000 0000 0000 0402 P.@.z...........
0x0030: 5374 6f63 6b20 4854 5450 2f31 2e31 Stock.HTTP/1.1
16:35:35.278642 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [P.], seq 0:258, ack 1, win 16560, length 258: HTTP: GET /getStock HTTP/1.1
0x0000: 4514 012a 7628 4000 7406 721f da4f c080 E..*v(@.t.r..O..
0x0010: ac10 d691 66e2 1f90 07bc 2432 05ae 1ecd ....f.....$2....
0x0020: 5018 40b0 1be2 0000 4745 5420 2f67 6574 P.@.....GET./get
0x0030: 5374 6f63 6b20 4854 5450 2f31 2e31 0d0a Stock.HTTP/1.1..
0x0040: 5365 632d 5765 6253 6f63 6b65 742d 5665 Sec-WebSocket-Ve
0x0050: 7273 696f 6e3a 2031 330d 0a53 6563 2d57 rsion:.13..Sec-W
0x0060: 6562 536f 636b 6574 2d4b 6579 3a20 6d69 ebSocket-Key:.mi
0x0070: 304e 3851 4677 5a55 4435 3969 3466 4748 0N8QFwZUD59i4fGH
0x0080: 364e 3951 3d3d 0d0a 436f 6e6e 6563 7469 6N9Q==..Connecti
0x0090: 6f6e 3a20 5570 6772 6164 650d 0a55 7067 on:.Upgrade..Upg
0x00a0: 7261 6465 3a20 7765 6273 6f63 6b65 740d rade:.websocket.
0x00b0: 0a53 6563 2d57 6562 536f 636b 6574 2d45 .Sec-WebSocket-E
0x00c0: 7874 656e 7369 6f6e 733a 2070 6572 6d65 xtensions:.perme
0x00d0: 7373 6167 652d 6465 666c 6174 653b 2063 ssage-deflate;.c
0x00e0: 6c69 656e 745f 6d61 785f 7769 6e64 6f77 lient_max_window
0x00f0: 5f62 6974 730d 0a4f 7269 6769 6e3a 2034 _bits..Origin:.4
0x0100: 372e 3938 2e31 3838 2e32 3338 0d0a 486f 7.98.188.238..Ho
0x0110: 7374 3a20 3437 2e39 382e 3138 382e 3233 st:.47.98.188.23
0x0120: 383a 3830 3830 0d0a 0d0a 0000 0000 0000 8:8080..........
0x0130: 0000 0000 0000 0000 0000 ..........
16:35:35.293889 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [.], ack 205, win 16509, length 0
0x0000: 4514 0028 7629 4000 7406 7320 da4f c080 E..(v)@.t.s..O..
0x0010: ac10 d691 66e2 1f90 07bc 2534 05ae 1f99 ....f.....%4....
0x0020: 5010 407d 793b 0000 0000 0000 0000 6574 P.@}y;........et
0x0030: 5374 6f63 6b20 4854 5450 2f31 2e31 Stock.HTTP/1.1
连接流出
16:35:35.267416 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [S.], seq 95297228, ack 129770546, win 42340, options [mss 1460,nop,nop,sackOK,nop,wscale 14], length 0
0x0000: 4500 0034 0000 4000 4006 1d52 ac10 d691 E..4..@.@..R....
0x0010: da4f c080 1f90 66e2 05ae 1ecc 07bc 2432 .O....f.......$2
0x0020: 8012 a564 1d99 0000 0204 05b4 0101 0402 ...d............
0x0030: 0103 030e 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 ....
16:35:35.278654 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [.], ack 259, win 3, length 0
0x0000: 4500 0028 4087 4000 4006 dcd6 ac10 d691 E..(@.@.@.......
0x0010: da4f c080 1f90 66e2 05ae 1ecd 07bc 2534 .O....f.......%4
0x0020: 5010 0003 1d8d 0000 0000 0000 0000 0000 P...............
0x0030: 0000 0000 0000 0000 ........
16:35:35.279085 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [P.], seq 1:185, ack 259, win 3, length 184: HTTP: HTTP/1.1 101 Switching Protocols
0x0000: 4500 00e0 4088 4000 4006 dc1d ac10 d691 E...@.@.@.......
0x0010: da4f c080 1f90 66e2 05ae 1ecd 07bc 2534 .O....f.......%4
0x0020: 5018 0003 1e45 0000 4854 5450 2f31 2e31 P....E..HTTP/1.1
0x0030: 2031 3031 2053 7769 7463 6869 6e67 2050 .101.Switching.P
0x0040: 726f 746f 636f 6c73 0d0a 5570 6772 6164 rotocols..Upgrad
0x0050: 653a 2077 6562 736f 636b 6574 0d0a 436f e:.websocket..Co
0x0060: 6e6e 6563 7469 6f6e 3a20 5570 6772 6164 nnection:.Upgrad
0x0070: 650d 0a53 6563 2d57 6562 736f 636b 6574 e..Sec-Websocket
0x0080: 2d41 6363 6570 743a 2064 4c53 5048 4e43 -Accept:.dLSPHNC
0x0090: 754a 5663 7644 5351 4564 5355 792f 5467 uJVcvDSQEdSUy/Tg
0x00a0: 6877 6363 3d0d 0a53 6563 2d57 6562 736f hwcc=..Sec-Webso
0x00b0: 636b 6574 2d56 6572 7369 6f6e 3a20 3133 cket-Version:.13
0x00c0: 0d0a 5365 7276 6572 3a20 7377 6f6f 6c65 ..Server:.swoole
0x00d0: 2d68 7474 702d 7365 7276 6572 0d0a 0d0a -http-server....
0x00e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
16:35:35.279180 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [P.], seq 185:205, ack 259, win 3, length 20: HTTP
0x0000: 4500 003c 4089 4000 4006 dcc0 ac10 d691 E..<@.@.@.......
0x0010: da4f c080 1f90 66e2 05ae 1f85 07bc 2534 .O....f.......%4
0x0020: 5018 0003 1da1 0000 8112 6865 6c6c 6f2c P.........hello,
0x0030: 2077 656c 636f 6d65 2120 3a29 0000 0000 .welcome!.:)....
0x0040: 0000 0000 0000 0000 0000 0000 ............
断开流入
16:35:55.314182 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [P.], seq 258:264, ack 205, win 16509, length 6: HTTP
0x0000: 4514 002e 796c 4000 7406 6fd7 da4f c080 E...yl@.t.o..O..
0x0010: ac10 d691 66e2 1f90 07bc 2534 05ae 1f99 ....f.....%4....
0x0020: 5018 407d 1f99 0000 8880 9a49 36ca 0302 P.@}.......I6...
0x0030: 0101 0402 0000 0000 0000 0000 0000 ..............
16:35:55.323659 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [.], ack 208, win 16508, length 0
0x0000: 4514 0028 796d 4000 7406 6fdc da4f c080 E..(ym@.t.o..O..
0x0010: ac10 d691 66e2 1f90 07bc 253a 05ae 1f9c ....f.....%:....
0x0020: 5010 407c 7933 0000 0000 0000 0000 0000 P.@|y3..........
0x0030: 0000 0000 0000 0000 0000 0000 0000 ..............
16:35:55.327189 IP 218.79.192.128.26338 > 172.16.214.145.webcache: Flags [F.], seq 264, ack 208, win 16508, length 0
0x0000: 4514 0028 796f 4000 7406 6fda da4f c080 E..(yo@.t.o..O..
0x0010: ac10 d691 66e2 1f90 07bc 253a 05ae 1f9c ....f.....%:....
0x0020: 5011 407c 7932 0000 0000 0000 0000 6574 P.@|y2........et
0x0030: 5374 6f63 6b20 4854 5450 2f31 2e31 Stock.HTTP/1.1
断开流出
16:35:55.314266 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [P.], seq 205:207, ack 265, win 3, length 2: HTTP
0x0000: 4500 002a 408a 4000 4006 dcd1 ac10 d691 E..*@.@.@.......
0x0010: da4f c080 1f90 66e2 05ae 1f99 07bc 253a .O....f.......%:
0x0020: 5018 0003 1d8f 0000 8800 5450 2f31 2e31 P.........TP/1.1
0x0030: 2031 3031 2053 7769 7463 .101.Switc
16:35:55.314542 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [F.], seq 207, ack 265, win 3, length 0
0x0000: 4500 0028 408b 4000 4006 dcd2 ac10 d691 E..(@.@.@.......
0x0010: da4f c080 1f90 66e2 05ae 1f9b 07bc 253a .O....f.......%:
0x0020: 5011 0003 1d8d 0000 8112 6865 6c6c 6f2c P.........hello,
0x0030: 2077 656c 636f 6d65 .welcome
16:35:55.327196 IP 172.16.214.145.webcache > 218.79.192.128.26338: Flags [.], ack 266, win 3, length 0
0x0000: 4500 0028 34c5 4000 4006 e898 ac10 d691 E..(4.@.@.......
0x0010: da4f c080 1f90 66e2 05ae 1f9c 07bc 253b .O....f.......%;
0x0020: 5010 0003 b9ab 0000 8800 6865 6c6c 6f2c P.........hello,
0x0030: 2077 656c 636f 6d65 .welcome
```
