怎么通过tcpdump抓取的包获得数据大小

gzc1210

通过tcpdump获得了流量、IP包的信息，可是如何能算出具体的数据有多大呢？

类似以下的内容。


14:59:51.750950 IP 192.168.1.1.38945 > iZ35g007gnpZ.mysql: Flags [P.], seq 3037595065:3037595125, ack 3241543252, win 351, options [nop,nop,TS val 2808305290 ecr 3043720630], length 60
14:59:51.751178 IP 192.168.1.1.38944 > iZ35g007gnpZ.mysql: Flags [.], ack 164, win 373, options [nop,nop,TS val 2808305290 ecr 3043730630], length 0
14:59:51.751368 IP iZ35g007gnpZ.mysql > 59.215.223.76.38945: Flags [P.], seq 1:164, ack 60, win 127, options [nop,nop,TS val 3043730631 ecr 2808305290], length 163
14:59:51.751686 IP 192.168.1.1.38945 > iZ35g007gnpZ.mysql: Flags [.], ack 164, win 373, options [nop,nop,TS val 2808305291 ecr 3043730631], length 0

phanx

回复 1# gzc1210


    用数据包的Length值减去包头，然后把所有的包加起来就是了。