# 先进到/tmp 目录执行，方便Filezila 传输
# 开启抓包
nohup tcpdump -i eth0 -s0 -nnA ‘port 22‘ -w dump22.pcap &
[1] 15022
# 查询pid
ps -ef|grep tcpdump |grep -v ‘grep‘
# 结束抓包
kill 15022
https://www.cnblogs.com/bonelee/p/6121821.html
原文：https://www.cnblogs.com/mysticbinary/p/12884136.html