tcpdump -A -s 0 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’
tcpdump -X -s 0 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’
tcpdump -c 200000 -w output.pcap -i any
tcpdump -r output.pcap -s 384 -i any -nnq -tttt ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’ > 80.txt
cut -c 12-21 port80.txt |awk ‘{print $1}’ | sort | uniq -c | awk ‘{print $2 ” ” $1}’ > packets_per_sec.txt
If your server in under ddos, sometimes tcpdump is quit useful:
time tcpdump -tnn -c 20000 -i em1 | awk -F "." '{print $1 "." $2 "." $3 "." $4}' | sort | uniq -c | sort -nr | awk '$1 > 100'