Instead of writing Snort rules or analyzing Tcpdump output, use Argus and some command-line switches to provide a minimal list of network connections.

The Net:: TcpDumpLog parses the raw network data saved by tcpdump.

TcpDumpLog会解析tcpdump所保存的原始网络数据。

Tcpdump is an essential tool for exploring low-level packet exchanges and verifying that your firewall is working correctly.

tcpdump是研究低级信息包交换和验证防火墙是否正常工作的必备工具。

Depending on the nature of the problem, it is sometimes good practice to run a tcpdump for a period of time while capturing packet information to a file using the-w switch.

根据问题的性质，有时候最好运行tcpdump一段时间，同时使用-w选项把数据包信息捕捉到文件中。

A newer tool called tcpflow complements tcpdump and provides a way to do protocol flow analysis and to properly reconstruct data streams, regardless of packet order or retransmissions.

一个叫做tcpflow的新工具与tcpdump相辅相成，它提供协议流分析和适当地重构数据流的方法，而不管数据包的顺序或重发。

You can also try the cross-platform tcpdump tool, which is supported on most UNIX and Linux operating systems.

您也可以尝试使用跨平台的tcpdump工具，它支持大多数的UNIX和Linux操作系统。

S0 tells tcpdump that you want all data in every packet body.

s0告诉tcpdump您想得到每个数据包主体中的所有数据。

In the UNIX world, useful tools are tcpdump, iftop, and bandwidth monitors such as wmnet.

在UNIX领域中，tcpdump、iftop和带宽监视工具（如wmnet）都是非常有价值的。

Using this basic framework you can perform more complex lookups and decoding that do not rely on the automated solutions provided by tcpdump or snoop.

通过使用这个基本的框架，您就能够执行不依赖于tcpdump或snoop的自动化解决方案的更复杂查询和解码。

As shown in this article, using tools like tcpdump, snoop or iptrace, you can extract a wide range of data at the command line.

如本文所述，通过使用诸如tcpdump、snoop或iptrace的工具，您可以在命令行上提取大量的数据。

Although, as already mentioned, tools like tcpdump, iptrace and snoop provide basic network analysis and decoding, there are GUI-based tools that make the process even easier.

虽然，正如之前提到的，诸如tcpdump、iptrace和snoop等工具都提供了基本的网络分析和解码功能，但是还有一些基于GUI的工具使这个过程更简单。

You can monitor outgoing data sent from a particular adapter using tcpdump, which displays the content of each packet as it is sent.

可以使用tcpdump监视从特定适配器发送出的数据，这个命令在发送每个数据包时显示其内容。

The tcpdump command is much more feature rich than the simple examples shown here, so I recommend that you familiarize yourself with its man pages.

tcpdump命令的特性比这些简单的示例丰富得多，所以我建议您熟悉它的手册页。

The-i lo option tells tcpdump what interface to listen on ( the loopback device, in this case).

i lo选项告诉tcpdump要侦听哪个接口（在这个例子中要侦听回送设备）。

Another way to process the content from tcpdump is to save the raw network packet data to a file and then process the file to find and decode the information that you want.

处理来自tcpdump的另一个方法是将原始网络数据包数据保存到一个文件中，然后处理这个文件以便查找和解码出您想要的信息。

The tcpdump and tcpflow tools give you a huge number of options, including the ability to create complex filter expressions.

tcpdump和tcpflow工具有大量的选项，包括创建复杂过滤表达式的能力。

One important difference with tcpdump is that, unlike iptrace, it can look at only one network interface at a time.

tcpdump的一个重要区别是，与iptrace不同，它一次只能查看一个网络接口。

The tcpdump tool is an older tool that "sniffs" network packets from a network and either prints them to stdout or logs them to a file.

tcpdump工具是一个比较老的工具，它从网上“嗅探”网络数据包，打印到stdout或记录在一个文件中。

With tcpdump, you can also limit the amount of data to be traced.

使用tcpdump，您还可以限制要跟踪的数据的总量。

Tcpdump, for example, is not just a tool for diagnosing network problems, but is invaluable for understanding how the protocols work.

比如说Tcpdump吧，它不仅仅是一个诊断网络问题的工具，更是一个辅助理解协议原理的无价之宝。

If you want tcpdump to keep only a set number of bytes per packet, enter the number of bytes desired in place of zero here.

如果您想让tcpdump只保持每个数据包一定数量的字节，请输入所期望的字节数来代替此处的零。