tcpdump 输出的问题

liuyubin76

输出里有： (DF) (ttl 241, id 14233, len 40)

想请问一下： len 40 是表示长度吗？是数据包的长度还是包头的长度？


另外，比如我正从服务器往本地拷文件，用 tcpdump 抓包，能否看到正在拷贝的文件名？

brokencluster

1....
man tcpdump

       -s     Snarf snaplen bytes of data from each  packet  rather  than  the
              default  of  68  (with SunOS's NIT, the minimum is actually 96).
              68 bytes is adequate for IP, ICMP, TCP and UDP but may  truncate
              protocol  information  from  name  server  and  NFS packets (see
              below).  Packets truncated because of  a  limited  snapshot  are
              indicated  in  the  output with ``[|proto]'', where proto is the
              name of the protocol level at which the truncation has occurred.
              Note  that  taking larger snapshots both increases the amount of
              time it takes to process packets and, effectively, decreases the
              amount  of packet buffering.  This may cause packets to be lost.
              You should limit snaplen to the smallest number that  will  cap-
              ture  the  protocol  information  you're interested in.  Setting
              snaplen to 0 means use the required length to catch whole  pack-
              ets.
2...
自己抓包看看。