Question

我正在尝试从定制设计的linux系统中捕获实时tcpdump。到目前为止，我正在使用的命令是：

plink.exe -ssh user@IP -pw PW "shell nstcpdump.sh -s0 -U -w - not port 22 and not host 127.0.0.1" | "C:\Program Files\Wireshark\wireshark" -i -

这将失败，因为在远程系统上执行命令时，此（自定义）外壳程序将在发送数据之前输出“完成”。我试图找出一种从外壳中删除“完成”消息的方法，但似乎没有。

因此，我想到了这个（添加了findstr -V）：

plink.exe -ssh user@IP -pw PW "shell nstcpdump.sh -s0 -U -w - not port 22 and not host 127.0.0.1" | findstr -V "Done" | "C:\Program Files\Wireshark\wireshark" -i -

这差不多可以正常工作，因为我会遇到一些错误，并且实时捕获将停止。我相信这可能与缓冲区有关，但是我不确定。

有谁知道从plink / remote shell删除/绕过输出的前几个字节/字符的其他方法吗？

[编辑] 根据要求，nstcpdump.sh是tcpdump的包装器。如前所述，该系统是高度定制的。 nstcpdump.sh代码：

root@hostname# cat /netscaler/nstcpdump.sh
#!/bin/sh
# piping the packet trace to the tcpdump
#
# FILE:         $Id: //depot/main/rs_120_56_14_RTM/usr.src/netscaler/scripts/nstcpdump.sh#1 $
# LAST CHECKIN: $Author: build $
#               $DateTime: 2017/11/30 02:14:38 $
#
#
# Options:      any TCPDUMP options
#
TCPDUMP_PIPE=/var/tmp/tcpdump_pipe

NETSCALER=${NETSCALER:-`cat /var/run/.NETSCALER`}
[ -r ${NETSCALER}/netscaler.conf ] && . ${NETSCALER}/netscaler.conf

TIME=${TIME:-3600}
MODE=${MODE:-6}
STARTCMD="start nstrace -size 0 -traceformat PCAP -merge ONTHEFLY -filetype PIPE -skipLocalSSH ENABLED"
STOPCMD="stop nstrace "
SHOWCMD="show nstrace "
NSCLI_FILE_EXEC=/netscaler/nscli
NSTRACE_OUT_FILE=/tmp/nstrace.out
NS_STARTTRACE_PIDFILE=/tmp/nstcpdump.pid
TRACESTATE=$(nsapimgr -d allvariables | grep tracestate | awk '{ print $2}')

trap nstcpdump_exit 1 2 15

nstcpdump_init()
{
        echo "##### WARNING #####"
        echo "This command has been deprecated."
        echo "Please use 'start nstrace...' command from CLI to capture nstrace."
        echo "trace will now start with all default options"
        echo "###################"
        if [ ! -d $NSTRACE_DIR ]
        then
                echo "$NSTRACE_DIR directory doesn't exist."
                echo "Possible reason: partition is not mounted."
                echo "Check partitions using mount program and try again."
                exit 1
        fi

        if [ ! -x $NSCLI_FILE_EXEC ]
        then
                echo "$NSCLI_FILE_EXEC binary doesn't exist"
                exit 1
        fi

        if [ -e $NSTRACE_OUT_FILE ]
        then
                rm $NSTRACE_OUT_FILE
                echo "" >> $NSTRACE_OUT_FILE
        fi

}
nstcpdump_start_petrace()
{
        sleep 0.5;
        $NSCLI_FILE_EXEC -U %%:.:. $STARTCMD >/tmp/nstcpdump.sh.out
        rm -f ${NS_STARTTRACE_PIDFILE}
}

nstcpdump_start()
{
        # exit if trace is already running
        if [ $TRACESTATE -ne 0 ]
        then
                echo "Error: one instance of nstrace is already running"
                exit 2
        fi

        nstcpdump_start_petrace &
        echo $! > ${NS_STARTTRACE_PIDFILE}
        tcpdump  -n -r - $TCPDUMPOPTIONS < ${TCPDUMP_PIPE}
        nstcpdump_exit
        exit 1
}

nstcpdump_exit()
{
        if [ -f ${NS_STARTTRACE_PIDFILE} ]
        then
                kill `cat ${NS_STARTTRACE_PIDFILE}`
                rm ${NS_STARTTRACE_PIDFILE}
        fi

        $NSCLI_FILE_EXEC -U %%:.:. $STOPCMD >> /dev/null
        exit 1
}

nstcpdump_usage()
{
        echo `basename $0`: utility to view/save/sniff LIVE packet capture on NETSCALER box
        tcpdump -h
        echo
        echo NOTE: tcpdump options -i, -r and -F are NOT SUPPORTED by this utility
        exit 0
}

########################################################################

while [ $# -gt 0 ]
do
        case "$1" in
        -h )
                nstcpdump_usage
                ;;
        -i )
                nstcpdump_usage
                ;;
        -r )
                nstcpdump_usage
                ;;
        -F )
                nstcpdump_usage
                ;;
        esac
        break;
done

TCPDUMPOPTIONS="$@"
check_ns nstcpdump
#nstcpdump_init
#set -e
if [ ! -e ${TCPDUMP_PIPE} ]
then
        mkfifo $TCPDUMP_PIPE
        if [ $? -ne 0 ]
        then
                echo "Failed creating pipe [$TCPDUMP_PIPE]"
                exit 1;
        fi
fi

nstcpdump_start

致谢

删除Windows Pipe上的第一行/字符

0 个答案: