tcpflow介绍
tcpflow和tcpdump差别，tcpflow需要指定参数-p的情况下才会开启混杂模式。
tcpflow常用的命令方式：tcpflow -cp -i eth0
tcpflow参数详解–直接复制tcpflow -h里面的点：
[root@TEST ~]# tcpflow -h
tcpflow version 0.21 by Jeremy Elson
usage: tcpflow [-chpsv] [-b max_bytes] [-d debug_level] [-f max_fds]
[-i iface] [-w file] [expression]
-b: max number of bytes per flow to save
-c: console print only (don’t create files)
-d: debug level; default is 1
-f: maximum number of file descriptors to use
-h: print this help message
-i: network interface on which to listen
(type “ifconfig -a” for a list of interfaces)
-p: don’t use promiscuous mode —开启混杂模式
-r: read packets from tcpdump output file
-s: strip non-printable characters (change to ‘.’)
-v: verbose operation equivalent to -d 10
expression: tcpdump-like filtering expression — 可以和tcpdump一样配置一定规则
