blocks|key|3144691|text|Tcpdump可以告诉您数据包来自/去往的PID/进程。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3144692|在你的选项中加入'-k+NP‘。|3144693|支持的版本:+tcpdump版本4.3.0+--+Apple版本56|3144694|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

Tcpdump can tell you the PID/process a packet comes from/to. 
Throw '-k NP' in your options.

Version supported: tcpdump version 4.3.0 -- Apple version 56

blocks|key|3144716|text|在我的例子中，我希望捕获syslog流量，但仅从rsyslog捕获。它在lsof+-p+$(pidof+rsyslog)下只有一个侦听端口，并且总是使用该端口作为源端口，所以我能够使用以下命令获取数据包：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3144717|tcpdump+-i+eth0+-A+"host+10.0.0.100+and+dst+port+514+and+src+port+$(lsof+-i+4+-a+-p+`pidof+rsyslogd`+%7C+grep+-Po+'(?<=\*:)[0-9]*')+and+udp"|code-block|syntax|javascript|3144718|将*：grep+uses+a+positive+lookbehind+assertion转换为端口号的端口号。|3144719|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/15136585/17373^0|10|O|0|0|3|15|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@]|D|@$9|Z|A|10|1|11]]|E|$]]|$1|M|3|-4|5|6|7|12|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

In my case I wanted to capture syslog traffic but only from rsyslog. It only had one listening port under <code>lsof -p $(pidof rsyslog)</code> and always used that as the source port, so I was able to get the packets using:

<pre><code>tcpdump -i eth0 -A "host 10.0.0.100 and dst port 514 and src port $(lsof -i 4 -a -p `pidof rsyslogd` | grep -Po '(?&lt;=\*:)[0-9]*') and udp"
</code></pre>

The <a href="https://stackoverflow.com/a/15136585/17373">grep uses a positive lookbehind assertion</a> to turn the *:portnumber into just the port number.

blocks|key|252118|text|不是直接的tcpdump，但可以提供有关网络流量的信息，请查看https://bytefreaks.net/gnulinux/how-to-capture-all-network-traffic-of-a-single-process|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|252119|strace+-f+-e+trace=network+-s+10000+<PROCESS+WITH+ARGUMENTS>;|code-block|syntax|javascript|252120|如果进程已经启动，并且您知道它的PID，则可以使用下面的1|252121|strace+-f+-e+trace=network+-s+10000+-p+<PID>;|252122|另一种选择是更复杂的，使用网络名称空间，检查上面的链接或使用工具nsntrace，但要么只能在新进程上工作，要么不能更改现有的进程网络名称空间(AFAIK)|252123|更新:你也可以安装工具bpfcc-tools+(搜索你的发行版，很多已经包含了)，并使用命令sudo+tcptracer-bpfcc+-v+-p+(PID)，虽然这不会显示数据包，但它会列出该pid的网络连接。您可以删除-p+(PID)以列出每个进程的所有连接。这对于那些跟踪短连接的人可能很有用，而不是网络有效负载。|style|CODE|252124|entityMap|0|LINK|mutability|MUTABLE|url|https://bytefreaks.net/gnulinux/how-to-capture-all-network-traffic-of-a-single-process|1|https://github.com/jonasdn/nsntrace^0|V|2E|0|0|0|0|0|W|8|1|0|1A|W|32|8|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|D|3|E|5|F|7|16|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|17|8|@]|9|@]|C|$]]|$1|K|3|L|5|F|7|18|8|@]|9|@]|C|$G|H]]|$1|M|3|N|5|6|7|19|8|@]|9|@$A|1A|B|1B|1|1C]]|C|$]]|$1|O|3|P|5|6|7|1D|8|@$A|1E|B|1F|Q|R]|$A|1G|B|1H|Q|R]]|9|@]|C|$]]|$1|S|3|-4|5|6|7|1I|8|@]|9|@]|C|$]]]|T|$U|$5|V|W|X|C|$Y|Z]]|10|$5|V|W|X|C|$Y|11]]]]

Not directly a tcpdump, but can give you info about the network traffic, check <a href="https://bytefreaks.net/gnulinux/how-to-capture-all-network-traffic-of-a-single-process" rel="nofollow noreferrer">https://bytefreaks.net/gnulinux/how-to-capture-all-network-traffic-of-a-single-process</a>
<pre><code>strace -f -e trace=network -s 10000 &lt;PROCESS WITH ARGUMENTS&gt;;
</code></pre>
If the process is already started and you know its PID you can use the following
1
<pre><code>strace -f -e trace=network -s 10000 -p &lt;PID&gt;;
</code></pre>
Another alternative is more complex, using network namespaces, check the above link or use the tool <a href="https://github.com/jonasdn/nsntrace" rel="nofollow noreferrer">nsntrace</a>, but either can only work on new process, you can not change existent process network namespaces (AFAIK)
UPDATE:
you can also install the tool bpfcc-tools (search for your distro, many have it included already) and use the command <code>sudo tcptracer-bpfcc -v -p (PID)</code>
While this will not show the packets, it will list network connections for that pid. You can remove the <code>-p (PID)</code> to list all connections per process. This may be useful for those tracking short live connections, not the network payload.

Anyone know an easy way to ask Linux to "display every internet packet to/from google chrome" or "display every internet packet to/from telnet process with PID 10275"?

The telnet example is not too useful, since I can just use wireshark or tcpdump to see all TCP conversations involving port 23. That and nobody uses telnet anymore. But sniffing all packets to/from complex applications which use many ports seems like a useful thing.

I found some related answers exploring different ways to corroborate ports and PIDs (or programs names) and such, but nothing about packets 

<ul>
<li><a href="https://stackoverflow.com/questions/838317/how-to-tie-a-network-connection-to-a-pid-without-using-lsof-or-netstat">How to tie a network connection to a PID without using lsof or netstat?</a></li>
<li><a href="https://stackoverflow.com/questions/3306138/how-i-can-get-ports-assosiated-to-aplication-that-oppened-them/3308198">How I can get ports associated to the application that opened them?</a></li>
<li><a href="https://stackoverflow.com/questions/4056850/how-to-do-like-netstat-p-but-faster/4057150">How to do like &quot;netstat -p&quot;, but faster?</a></li>
</ul>

Looks like someone might have been willing to pay for this answer a while back:

<ul>
<li><a href="http://www.freelancer.com/projects/Perl-CGI-C-C/tcpdump-PID-relation.html" rel="noreferrer">http://www.freelancer.com/projects/Perl-CGI-C-C/tcpdump-PID-relation.html</a></li>
</ul>

<a href="http://nethogs.sourceforge.net/" rel="noreferrer">NetHogs</a> is useful for quickly seeing what programs are creating traffic over an interface, but it doesn't have a way to capture packets.

How can I capture network packets per PID?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

有谁知道一个简单的方法来要求Linux“显示每一个发往/来自google chrome的互联网数据包”或者“用PID 10275显示每一个发往/来自telnet进程的互联网数据包”？telnet示例用处不大，因为我只能使用wireshark或tcpdump查看所有涉及端口23的TCP会话。这样就没有人再用telnet了...

问如何捕获每个PID的网络数据包？
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何捕获每个PID的网络数据包？EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何捕获每个PID的网络数据包？
EN