This article provides a thorough walkthrough of tcpdump, covering installation on Ubuntu, essential command‑line options, practical filtering techniques, logical expressions, examples for saving and reading capture files, and how to combine tcpdump with Wireshark for deeper packet analysis.
This article describes the background, functional requirements, architecture, packet‑capture implementation using libpcap, MySQL protocol parsing, result processing, and storage strategy (Kafka + ClickHouse) of a custom MySQL sniffer developed at Qunar to provide complete database access logs for auditing, performance analysis, and operations.
This article explains the internal mechanisms of tcpdump, showing how it registers a virtual protocol in the kernel's ptype_all list to intercept packets during both receive and transmit paths, how netfilter interacts with these paths, and provides guidance for building a custom packet‑capture program.
This article compares four classic Linux packet‑capture engines—libpcap (and its mmap variant), PF_RING, DPDK, and XDP—explaining their data‑flow architectures, copy operations, zero‑copy techniques, and typical use‑cases such as DDoS defense and high‑speed networking.
This article compares four classic Linux packet‑capture engines—libpcap, libpcap‑mmap, PF_RING, DPDK, and XDP—detailing their data‑path architectures, copy‑count reductions, zero‑copy techniques, and typical use‑cases such as DDoS defense and high‑speed trading.
The article presents a method that leverages HBase to capture, store, index, and quickly retrieve massive network packets, using PF_RING and libpcap for high‑performance capture and providing APIs for time‑, IP‑, protocol‑, and port‑based packet backtracking.
