Tcp programming linux

What protocol does the nc command of Linux use? How to grab it with tcpdump?

The nc command supports both tcp and udp, and the port number is completely controlled by itself, so there is no tcpdump command format specifically for nc.

Why can't my tcpdump run under linux?

Tcpdump captures messages through libpcap, which has different implementations on different platforms. The following is only a description of the Linux platform. First of all, it is nothing special for Linux platform to obtain link layer information such as Mac address of messages in user mode, which can be realized by AF_PACK socket, and it is also the way for tcpdump or libpcap to capture messages (which can be verified by the system call of stracetcpdump). See man7packet for more information about AF_PACK. Secondly, as mentioned above, tcpdumap uses AF_PACK socket instead of Netfilter. There are at least two unreasonable points in using Netfilter:

1. When the packet enters Netfilter, it has actually been processed in the protocol stack, and the packet may have changed. An obvious example is that the fragments need to be reorganized before entering Netfilter, so the original message fragments cannot be captured in Netfilter. In the sending direction, when the message leaves Netfilter, the processing of the protocol stack is not completely completed, so the captured message may be incomplete.

2. When passing to user mode, the message captured in Netfilter will be more complicated. Netfilter's code is in interrupt context and process context, so traditional system calls cannot be used. The simple way is to use Netlink. This is not as simple as grabbing messages directly with AF_PACKET (both kernel and user-mode programs).

I want to learn embedded linux programming recently. Can you recommend some classic books to me?

Share my process of learning Linux.

I have been studying Linux for more than three years, and I have only started to get in touch with it frequently in the last two years. I haven't bought a book until now. My study method may be different from others.

Contact with linux system begins with getting the powerful software of "virtual machine". I installed many versions of Linux system in this software, such as Ubuntu, Linux, Deep System and domestic neokylin system. The previous Linux systems have different names, and the remaining Linux systems are Ubuntu systems. Because this system looks simpler, it is more convenient to learn.

In fact, these operating systems cannot be learned. Simply put, you just need to operate them more. Just like learning win system, the real computer rank test is not only to teach you how to operate the document writing software simply, but I think the content of my previous computer rank test is out of date now.

I bought a raspberry pie last year, which is also a Linux system. Since then, I have been tossing in the Linux system. I don't know how many times I lost many orders before I forgot them.

At the beginning of this year, the company needed to develop software under Linux, involving Linux system kernel compilation, bottom-level driver writing, Linux system network setting, top-level software calling bottom-level driver interface, qt source code compilation, QT software development, arm cross-compilation environment deployment, shell script programming, sqlite database use, TCP programming and so on.

Generally speaking, the premise of learning Linux well is that you have a Linux system to operate continuously. Share good methods, and remember to record the commands you have operated when you study. I didn't remember it at first, then I forgot it, and I had to find it again when I wanted to use it. As for the tutorial, there is a very systematic tutorial online, which feels similar to the book. If you encounter something you can't do, write it down with Baidu, the solution of the predecessors.

How does tcpdump of Linux display message content? What parameters are used? Like thank you?

Packet capture command tcpdumptcp-Aport22-wa.cap stores the message content in a.cap, which is a binary file and needs to be read by ethreal tool.