gojue/ecapture

tls子命令可否支持ip过滤

Closed this issue · 6 comments

onlytiancai commented

./ecapture tls 问下只有--port参数，没看到--host或--ip的参数，有计划支持吗？

  • 一般生产环境不会全量抓包，比如就专门指定客户端IP抓这个客户的包之类
  • 或者就是调试个网络请求啥的，类似 tcpdump -i eth0 host 192.168.0.1 and port 80
cfc4n commented

@Asphaltt 大神有个更好地解决方案 pcap filter ，未来会支持这个功能。

Expert @Asphaltt has a better solution pcap filter, which will be supported in the future.

Asphaltt commented

Do you mean elibpcap library?

It will be nice to support pcap filter expression like tcpdump.

@cfc4n WDYT?

cfc4n commented

好像也只能如此了。 这周我测试github.com/Asphaltt/tc-dump在android上的兼容性。

It seems that this is the only way. This week, I tested the compatibility of github.com/Asphaltt/tc-dump on Android.

  • 👍1
Asphaltt commented

I tested the compatibility of github.com/Asphaltt/tc-dump on Android.

Great.

One more question: is --port=443 required? It will conflict with pcap-filter when there's tcp port 8080 in pcap-filter at the same time.

cfc4n commented

Well, the '--port' argument does conflict with 'pcap-fliter' and can be removed

嗯，--port参数确实会跟pcap-fliter产生冲突，可以去掉。

Asphaltt commented

can be removed

Good. I'm on it.

  • 🎉1