Android tcpdump TCP 抓包

0x01 概述

本文将介绍安卓模拟器环境下面使用tcpdump抓包的方法，适合小白用户查看。

0x02 安装指南

2.1 环境信息

笔记本: MacBook Pro 2020款 13寸
MacOS: 10.15.5
模拟器: 网易Mumu 1.9.15，已开启root权限
Wireshark: 3.2.4

2.2 安装脚本

#!/bin/bash

shell_script_path=$(cd `dirname $0`; pwd)

tcpdump_local_path="${shell_script_path}/tcpdump"

if [ ! -f "${tcpdump_local_path}" ]; then
  cd ${shell_script_path}
  curl -O http://www.androidtcpdump.com/download/4.9.0/tcpdump
  echo -e "download tcpdump at path ${shell_script_path}"
fi

if [ -f "${tcpdump_local_path}" ]; then
    echo -e "findout tcpdump ${tcpdump_local_path}"
else
    echo -e "download tcpdump fail"
    exit 1
fi
adb push "${tcpdump_local_path}" /data/local/tcpdump
adb shell chmod 6755 /data/local/tcpdump
echo -e "install tcpdump success"
echo -e "You can use like
adb shell as root!
cd /data/local/
./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

Then exit shell
adb pull /sdcard/capture.pcap .
"

echo -e "Do you want delete tcpdump file (y) ?"
read isDeleteDownload
if [ ${isDeleteDownload} == "y" ]; then
  rm -f ${tcpdump_local_path}
  echo -e "success remove ${tcpdump_local_path}"
fi

2.3 手动安装

1、tcpdump for android 在这里下载：

2、使用adb push命令将tcpdump上传到安卓模拟器中，然后添加执行权限

adb push ~/Downloads/tcpdump /data/local/tcpdump
adb shell chmod 6755 /data/local/tcpdump

0x03 操作指南

tcpdump 需要在命令行运行目录中存在

cd /data/local
./tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

拉取抓获的tcp/udp包

adb pull /sdcard/capture.pcap

用wireshark打开capture.pcap即可分析log

tcpdump 参数说明

"-i any": listen on any network interface
"-p": disable promiscuous mode (doesn't work anyway)
"-s 0": capture the entire packet
"-w": write packets to a file (rather than printing to stdout)
... do whatever you want to capture, then ^C to stop it ...

本文转自：https://www.jianshu.com/p/ca6cdc825ad3

3 comments

菜鸡
August 22nd, 2020 at 09:17 am

经常逛逛大佬的博客总有收获，感谢

求smtp操作
August 19th, 2020 at 12:48 am

您好，怎么联系？

1. 独自等待
  August 19th, 2020 at 11:35 am
  
  @求smtp操作
  
  想问啥直接留言就行了。