tcpdump抓取服务器主动发起请求情况

1.编辑脚本

yum install -y tcpdump

cat > /usr/local/sbin/tcpdump-outbound.sh <<'EOF'
#!/bin/bash
exec /usr/sbin/tcpdump -l -i any -nn -tttt \
'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn and not dst net 10.0.0.0/8 and not dst net 172.16.0.0/12 and not dst net 192.168.0.0/16' \
>> /var/log/tcpdump-outbound.log 2>&1
EOF 

chmod 700 /usr/local/sbin/tcpdump-outbound.sh
mkdir -p /var/log
touch /var/log/tcpdump-outbound.log
chmod 600 /var/log/tcpdump-outbound.log

2.设置系统服务，开启自启动

cat > /etc/systemd/system/tcpdump-outbound.service <<'EOF'
[Unit]
Description=TCPDump Outbound SYN Monitor
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/sbin/tcpdump-outbound.sh
Restart=always
RestartSec=5
StandardOutput=null
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF


systemctl daemon-reload
systemctl enable tcpdump-outbound.service
systemctl start tcpdump-outbound.service
systemctl status tcpdump-outbound.service

3.主动向外发起请求

curl www.baidu.com

4.查看日志是否记录

查看日志
tail -10f /var/log/tcpdump-outbound.log

2026-10-12 14:18:47.103340 IP 172.17.201.98.42928 > 183.2.172.177.80: Flags [S], seq 2025537371, win 29200, options [mss 1460,sackOK,TS val 18195164 ecr 0,nop,wscale 7], length 0

记录发往这两个网段192.2.0.0/16、192.1.0.0/16的 SYN 和 SYN-ACK 包

tcpdump -i any -nn -tttt \
'tcp and (dst net 192.1.0.0/16 or dst net 192.2.0.0/16) and (tcp[tcpflags] & tcp-syn != 0)'