{"id":43791,"date":"2026-10-01T10:01:48","date_gmt":"2026-10-01T03:01:48","guid":{"rendered":"https:\/\/interdata.vn\/blog\/?p=43791"},"modified":"2026-10-01T10:01:48","modified_gmt":"2026-10-01T03:01:48","slug":"lenh-tcpdump","status":"publish","type":"post","link":"https:\/\/interdata.vn\/blog\/lenh-tcpdump\/","title":{"rendered":"H\u01b0\u1edbng D\u1eabn S\u1eed D\u1ee5ng L\u1ec7nh tcpdump Tr\u00ean Linux T\u1eeb C\u01a1 B\u1ea3n \u0110\u1ebfn N\u00e2ng Cao"},"content":{"rendered":"<p>Trong qu\u1ea3n tr\u1ecb m\u00e1y ch\u1ee7, <strong>l\u1ec7nh tcpdump<\/strong> l\u00e0 c\u00f4ng c\u1ee5 d\u00f2ng l\u1ec7nh ti\u00eau chu\u1ea9n d\u00f9ng \u0111\u1ec3 b\u1eaft, ph\u00e2n t\u00edch v\u00e0 tr\u00edch xu\u1ea5t c\u00e1c g\u00f3i tin m\u1ea1ng truy\u1ec1n qua giao di\u1ec7n m\u1ea1ng tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Linux. Qu\u1ea3n tr\u1ecb vi\u00ean s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 n\u00e0y \u0111\u1ec3 c\u00f4 l\u1eadp l\u1ed7i k\u1ebft n\u1ed1i \u1ee9ng d\u1ee5ng, ph\u00e1t hi\u1ec7n c\u00e1c \u0111\u1ee3t l\u01b0u l\u01b0\u1ee3ng b\u1ea5t th\u01b0\u1eddng ho\u1eb7c gi\u00e1m s\u00e1t qu\u00e1 tr\u00ecnh b\u1eaft tay TCP tr\u1ef1c ti\u1ebfp tr\u00ean terminal. M\u00f4i tr\u01b0\u1eddng h\u1ea1 t\u1ea7ng m\u00e1y ch\u1ee7 t\u1ea1i <a href=\"https:\/\/interdata.vn\/\">InterData<\/a> cung c\u1ea5p quy\u1ec1n ki\u1ec3m so\u00e1t root tuy\u1ec7t \u0111\u1ed1i, h\u1ed7 tr\u1ee3 k\u1ef9 s\u01b0 v\u1eadn h\u00e0nh tri\u1ec3n khai c\u00e1c t\u00e1c v\u1ee5 ch\u1ea9n \u0111o\u00e1n m\u1ea1ng chuy\u00ean s\u00e2u n\u00e0y nhanh ch\u00f3ng.<\/p>\n<div style=\"background-color: #eff6ff; padding: 20px; border: 1.5px solid #BFDBFE; border-radius: 12px; margin-bottom: 40px; box-shadow: 0 8px 20px rgba(37,99,235,0.05);\">\n<p style=\"font-family: 'Be Vietnam Pro', sans-serif; font-weight: bold; font-size: 18px; margin: 0 0 15px; color: #1e3a8a;\">N\u1ed8I DUNG B\u00c0I VI\u1ebeT<\/p>\n<ul style=\"list-style-type: none; padding-left: 0; margin: 0;\">\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section1\">1. tcpdump l\u00e0 g\u00ec v\u00e0 ho\u1ea1t \u0111\u1ed9ng nh\u01b0 th\u1ebf n\u00e0o?<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section2\">2. So s\u00e1nh tcpdump, Wireshark v\u00e0 tshark<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section3\">3. C\u00e0i \u0111\u1eb7t tcpdump tr\u00ean Linux<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section4\">4. C\u00e1c l\u1ec7nh tcpdump c\u01a1 b\u1ea3n c\u1ea7n bi\u1ebft khi b\u1eaft g\u00f3i tin<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section5\">5. B\u1ed9 l\u1ecdc tcpdump n\u00e2ng cao v\u1edbi BPF filter<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section6\">6. C\u00e1c use case th\u1ef1c t\u1ebf c\u1ee7a l\u1ec7nh tcpdump tr\u00ean VPS<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section7\">7. L\u01b0u v\u00e0 \u0111\u1ecdc file .pcap v\u1edbi l\u1ec7nh tcpdump<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section8\">8. X\u1eed l\u00fd s\u1ef1 c\u1ed1 th\u01b0\u1eddng g\u1eb7p khi d\u00f9ng l\u1ec7nh tcpdump<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#faq\">9. C\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p (FAQ)<\/a><\/li>\n<\/ul>\n<\/div>\n\n\n<style>\n.interdata-plan-carousel,.interdata-plan-carousel *{box-sizing:border-box}\n.interdata-plan-carousel{--blue:#005bea;--blue-dark:#004dcc;--text:#071832;--muted:#516173;--border:#d8e6fb;--bg:#f3f8ff;--shadow:0 5px 14px rgba(0,62,145,.08);background:var(--bg);padding:14px 56px 18px;position:relative;overflow:hidden;border-radius:20px;}\n.interdata-carousel-heading{color:#f00;font-family:Roboto,sans-serif;font-size:18px;line-height:1.35;font-weight:800;text-align:center;margin:0 0 14px}\n.interdata-plan-viewport{overflow:hidden;width:100%}\n.interdata-plan-track{display:flex;align-items:stretch;gap:12px;overflow:visible;padding:0 0 4px;transform:translate3d(0,0,0);transition:transform .45s ease;will-change:transform;touch-action:pan-y}\n.interdata-plan-card{flex:0 0 calc((100% - 24px)\/3);min-width:0;min-height:0!important;height:auto;background:#fff;border:1px solid var(--border);border-radius:8px;padding:15px 12px 13px;display:flex;flex-direction:column;box-shadow:var(--shadow)}\n.interdata-plan-title{color:var(--blue-dark);font-size:16px;line-height:1.22;font-weight:800;text-align:center;margin:0 0 7px;text-transform:uppercase;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}\n.interdata-plan-price{color:var(--blue-dark);font-size:24px;line-height:1;font-weight:900;text-align:center;margin-bottom:12px;white-space:nowrap;letter-spacing:0}\n.interdata-plan-price span{font-size:10px;font-weight:800;margin-left:2px}\n.interdata-plan-badge{align-self:center;display:inline-flex;align-items:center;justify-content:center;background:#ff3934;color:#fff;border-radius:5px;padding:7px 8px;font-size:9px;line-height:1;font-weight:800;margin-bottom:15px;white-space:nowrap;max-width:100%}\n.interdata-plan-features{list-style:none!important;padding:0!important;margin:0!important}\n.interdata-plan-features li{display:flex;gap:7px;align-items:flex-start;color:var(--text);font-size:12px;line-height:1.35;font-weight:700;text-align:left;margin:0 0 10px!important;padding:0!important}\n.interdata-plan-icon{width:14px;min-width:14px;height:14px;color:#0069ff;margin-top:2px}\n.interdata-plan-icon svg{display:block;width:100%;height:100%;fill:none;stroke:currentColor;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}\n.interdata-plan-spacer{flex:1;min-height:16px}\n.interdata-plan-button{display:flex;align-items:center;justify-content:center;min-height:42px;width:100%;margin-top:auto!important;margin-bottom:0!important;background:var(--blue);color:#fff!important;border-radius:5px;font-size:13px;font-weight:800;text-decoration:none!important;box-shadow:0 7px 14px rgba(0,91,234,.24);transition:transform .2s ease,background .2s ease}\n.interdata-plan-button:hover{background:var(--blue-dark);color:#fff!important;transform:translateY(-1px)}\n.interdata-carousel-arrow{position:absolute;top:50%;z-index:5;width:44px;height:54px;border:2px solid #fff!important;border-radius:999px;background:var(--blue)!important;color:#fff!important;box-shadow:0 8px 22px rgba(0,62,145,.32);display:flex!important;align-items:center;justify-content:center;cursor:pointer;transform:translateY(-35%);transition:background .2s ease,color .2s ease,opacity .2s ease,transform .2s ease}\n.interdata-carousel-arrow:hover{background:var(--blue-dark)!important;color:#fff!important;transform:translateY(-35%) scale(1.04)}\n.interdata-carousel-arrow:disabled{opacity:.78;cursor:not-allowed;background:#8aa6cf!important;color:#fff!important}\n.interdata-carousel-arrow:disabled:hover{background:#8aa6cf!important;color:#fff!important;transform:translateY(-35%)}\n.interdata-carousel-arrow svg{display:none!important}\n.interdata-carousel-arrow:before{content:none!important;display:none!important}\n.interdata-carousel-mark{display:block!important;color:#fff!important;font-family:Arial,Helvetica,sans-serif!important;font-size:38px!important;font-weight:900!important;line-height:1!important;text-align:center!important;pointer-events:none!important;transform:translateY(-2px)}\n.interdata-carousel-prev{left:14px}\n.interdata-carousel-prev .interdata-carousel-mark{margin-left:-2px}\n.interdata-carousel-next{right:14px}\n.interdata-carousel-next .interdata-carousel-mark{margin-right:-2px}\n@media (max-width:800px){.interdata-plan-carousel{padding:12px 44px 16px}.interdata-plan-card{flex-basis:calc((100% - 12px)\/2)}.interdata-carousel-heading{font-size:16px}.interdata-carousel-prev{left:6px}.interdata-carousel-next{right:6px}}\n@media (max-width:480px){.interdata-plan-carousel{padding:12px 38px 16px}.interdata-plan-card{flex-basis:100%}.interdata-plan-price{font-size:23px}.interdata-carousel-arrow{width:34px;height:44px}.interdata-carousel-mark{font-size:32px!important}.interdata-carousel-prev{left:3px}.interdata-carousel-next{right:3px}}\n<\/style>\n\n<div class=\"interdata-plan-carousel\" data-interdata-carousel>\n  <div class=\"interdata-carousel-heading\">Si\u00eau \u01afu \u0110\u00e3i VPS \/ CLOUD SERVER - Ti\u1ebft Ki\u1ec7m \u0110\u1ebfn 70%<\/div>\n\n  <svg width=\"0\" height=\"0\" style=\"position:absolute;visibility:hidden\" aria-hidden=\"true\">\n    <symbol id=\"id-icon-cpu\" viewBox=\"0 0 24 24\"><rect x=\"7\" y=\"7\" width=\"10\" height=\"10\" rx=\"2\"><\/rect><path d=\"M4 9h3M4 15h3M17 9h3M17 15h3M9 4v3M15 4v3M9 17v3M15 17v3\"><\/path><path d=\"M10 10h4v4h-4z\"><\/path><\/symbol>\n    <symbol id=\"id-icon-ram\" viewBox=\"0 0 24 24\"><rect x=\"4\" y=\"8\" width=\"16\" height=\"8\" rx=\"2\"><\/rect><path d=\"M7 16v2M11 16v2M15 16v2M19 16v2M7 11h1M11 11h1M15 11h1\"><\/path><\/symbol>\n    <symbol id=\"id-icon-storage\" viewBox=\"0 0 24 24\"><rect x=\"6\" y=\"3\" width=\"12\" height=\"18\" rx=\"2\"><\/rect><path d=\"M9 7h6\"><\/path><circle cx=\"12\" cy=\"16\" r=\"1.5\"><\/circle><\/symbol>\n    <symbol id=\"id-icon-network\" viewBox=\"0 0 24 24\"><path d=\"M5 12.5a10 10 0 0 1 14 0\"><\/path><path d=\"M8.5 16a5 5 0 0 1 7 0\"><\/path><path d=\"M12 19h.01\"><\/path><\/symbol>\n    <symbol id=\"id-icon-gift\" viewBox=\"0 0 24 24\"><rect x=\"3\" y=\"8\" width=\"18\" height=\"13\" rx=\"2\"><\/rect><path d=\"M12 8v13M3 12h18\"><\/path><path d=\"M7.5 8C6.1 8 5 6.9 5 5.5S6.1 3 7.5 3C10 3 12 8 12 8\"><\/path><path d=\"M16.5 8C17.9 8 19 6.9 19 5.5S17.9 3 16.5 3C14 3 12 8 12 8\"><\/path><\/symbol>\n  <\/svg>\n\n  <button class=\"interdata-carousel-arrow interdata-carousel-prev\" type=\"button\" aria-label=\"Xem 3 g\u00f3i tr\u01b0\u1edbc\" onclick=\"var r=this.closest('[data-interdata-carousel]');if(!r)return false;var t=r.querySelector('.interdata-plan-track'),c=t?t.querySelectorAll('.interdata-plan-card'):[];if(!t||!c.length)return false;var v=window.matchMedia('(max-width:480px)').matches?1:(window.matchMedia('(max-width:800px)').matches?2:3),m=Math.max(0,c.length-Math.min(v,c.length||1)),s=[],i=0;while(i&lt;m){s.push(i);i+=v}if(!s.length||s[s.length-1]!==m)s.push(m);var p=parseInt(r.getAttribute('data-inline-page')||'0',10);p=(p-1+s.length)%s.length;r.setAttribute('data-inline-page',p);var g=parseFloat(window.getComputedStyle(t).gap)||12,w=c[0].getBoundingClientRect().width;t.style.transition='transform .45s ease';t.style.transform='translate3d('+(-(w+g)*s[p])+'px,0,0)';return false;\">\n    <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M15 18l-6-6 6-6\"><\/path><\/svg>\n    <span class=\"interdata-carousel-mark\" aria-hidden=\"true\">&#8249;<\/span>\n  <\/button>\n\n  <div class=\"interdata-plan-viewport\">\n    <div class=\"interdata-plan-track\">\n      <!-- 7 card d\u1ef1 ph\u00f2ng: JavaScript s\u1ebd \u0111\u1ed3ng b\u1ed9 l\u1ea1i t\u1eeb API portal khi trang t\u1ea3i. -->\n      <article class=\"interdata-plan-card\" data-plan-pid=\"490\">\n        <h3 class=\"interdata-plan-title\">Premium Base<\/h3>\n        <div class=\"interdata-plan-price\">299.000 \u0111<span>\/3 th\u00e1ng<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>2 vCore Intel Xeon Scalable<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>2 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>30 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-value-plans-2026\/best-value-plans-premium-base\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"529\">\n        <h3 class=\"interdata-plan-title\">INTER PLATINUM 1<\/h3>\n        <div class=\"interdata-plan-price\">998.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>2 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>3 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>30 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/inter-platinum-series-2026\/inter-platinum-1\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"530\">\n        <h3 class=\"interdata-plan-title\">INTER PLATINUM 2<\/h3>\n        <div class=\"interdata-plan-price\">2.666.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>5 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>8 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>70 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/inter-platinum-series-2026\/inter-platinum-2\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"531\">\n        <h3 class=\"interdata-plan-title\">INTER PLATINUM 3<\/h3>\n        <div class=\"interdata-plan-price\">5.888.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>9 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>16 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>140 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/inter-platinum-series-2026\/inter-platinum-3\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"521\">\n        <h3 class=\"interdata-plan-title\">BD-Cloud 1<\/h3>\n        <div class=\"interdata-plan-price\">988.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>3 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>3 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>30 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-plan-real-cloud\/bd-cloud-1\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"522\">\n        <h3 class=\"interdata-plan-title\">BD-Cloud 2<\/h3>\n        <div class=\"interdata-plan-price\">2.988.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>4 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>8 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>80 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300 Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-plan-real-cloud\/bd-cloud-2\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"523\">\n        <h3 class=\"interdata-plan-title\">BD-Cloud 3<\/h3>\n        <div class=\"interdata-plan-price\">5.999.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>8 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>16 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>140 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>400 Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-plan-real-cloud\/bd-cloud-3\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n    <\/div>\n  <\/div>\n\n  <button class=\"interdata-carousel-arrow interdata-carousel-next\" type=\"button\" aria-label=\"Xem 3 g\u00f3i ti\u1ebfp theo\" onclick=\"var r=this.closest('[data-interdata-carousel]');if(!r)return false;var t=r.querySelector('.interdata-plan-track'),c=t?t.querySelectorAll('.interdata-plan-card'):[];if(!t||!c.length)return false;var v=window.matchMedia('(max-width:480px)').matches?1:(window.matchMedia('(max-width:800px)').matches?2:3),m=Math.max(0,c.length-Math.min(v,c.length||1)),s=[],i=0;while(i&lt;m){s.push(i);i+=v}if(!s.length||s[s.length-1]!==m)s.push(m);var p=parseInt(r.getAttribute('data-inline-page')||'0',10);p=(p+1)%s.length;r.setAttribute('data-inline-page',p);var g=parseFloat(window.getComputedStyle(t).gap)||12,w=c[0].getBoundingClientRect().width;t.style.transition='transform .45s ease';t.style.transform='translate3d('+(-(w+g)*s[p])+'px,0,0)';return false;\">\n    <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M9 18l6-6-6-6\"><\/path><\/svg>\n    <span class=\"interdata-carousel-mark\" aria-hidden=\"true\">&#8250;<\/span>\n  <\/button>\n<\/div>\n\n<script>\n(function(){\n  var API_GROUPS=[\n    {url:'https:\/\/support.interdata.vn\/packages.php?gid=89&module',pids:[490]},\n    {url:'https:\/\/support.interdata.vn\/packages.php?gid=100&module',pids:[529,530,531]},\n    {url:'https:\/\/support.interdata.vn\/packages.php?gid=97&module',pids:[521,522,523]}\n  ];\n  var PLAN_CYCLES={\n    490:{key:'quarterly',label:'3 th\u00e1ng'},\n    529:{key:'annually',label:'n\u0103m'},\n    530:{key:'annually',label:'n\u0103m'},\n    531:{key:'annually',label:'n\u0103m'},\n    521:{key:'annually',label:'n\u0103m'},\n    522:{key:'annually',label:'n\u0103m'},\n    523:{key:'annually',label:'n\u0103m'}\n  };\n\n  function fetchPlanData(){\n    if(window.interdataPlanApiPromise)return window.interdataPlanApiPromise;\n\n    window.interdataPlanApiPromise=Promise.all(API_GROUPS.map(function(group){\n      return fetch(group.url,{method:'GET',mode:'cors',cache:'no-store'})\n        .then(function(response){\n          if(!response.ok)throw new Error('API '+response.status);\n          return response.json();\n        })\n        .then(function(data){\n          if(!data||data.success!==true||!Array.isArray(data.products))return [];\n          return data.products.filter(function(product){\n            return group.pids.indexOf(Number(product.pid))!==-1;\n          });\n        })\n        .catch(function(error){\n          console.warn('Kh\u00f4ng th\u1ec3 c\u1eadp nh\u1eadt nh\u00f3m g\u00f3i InterData:',group.url,error);\n          return [];\n        });\n    })).then(function(groups){\n      return groups.reduce(function(all,products){return all.concat(products);},[]);\n    });\n\n    return window.interdataPlanApiPromise;\n  }\n\n  function parseDescription(html){\n    var source=String(html||'')\n      .replace(\/<brs*\/?>\/gi,'n')\n      .replace(\/<\/(p|div|li)>\/gi,'n');\n    var holder=document.createElement('div');\n    holder.innerHTML=source;\n    var strong=holder.querySelector('strong');\n    var badge=strong?strong.textContent.trim():'';\n    var lines=(holder.textContent||'').split(\/r?n\/).map(function(line){\n      return line.trim();\n    }).filter(Boolean);\n    if(badge&&lines[0]===badge)lines.shift();\n    return {badge:badge,features:lines};\n  }\n\n  function iconForFeature(feature){\n    if(\/ram\/i.test(feature))return 'id-icon-ram';\n    if(\/ssd|nvme|storage|disk\/i.test(feature))return 'id-icon-storage';\n    if(\/vcore|vcpu|cpu|xeon|amd\/i.test(feature))return 'id-icon-cpu';\n    if(\/ipv4|network|mbps|gbps|bandwidth\/i.test(feature))return 'id-icon-network';\n    return 'id-icon-gift';\n  }\n\n  function createFeatureItem(feature){\n    var item=document.createElement('li');\n    var icon=document.createElement('span');\n    var svg=document.createElementNS('http:\/\/www.w3.org\/2000\/svg','svg');\n    var use=document.createElementNS('http:\/\/www.w3.org\/2000\/svg','use');\n    icon.className='interdata-plan-icon';\n    use.setAttribute('href','#'+iconForFeature(feature));\n    svg.appendChild(use);\n    icon.appendChild(svg);\n    item.appendChild(icon);\n    item.appendChild(document.createTextNode(feature));\n    return item;\n  }\n\n  function updateCardFromApi(root,product){\n    var pid=Number(product.pid);\n    var cycle=PLAN_CYCLES[pid];\n    var card=root.querySelector('[data-plan-pid=\"'+pid+'\"]');\n    if(!card||!cycle)return;\n\n    var title=card.querySelector('.interdata-plan-title');\n    var priceBox=card.querySelector('.interdata-plan-price');\n    var badgeBox=card.querySelector('.interdata-plan-badge');\n    var featureList=card.querySelector('.interdata-plan-features');\n    var button=card.querySelector('.interdata-plan-button');\n    var description=parseDescription(product.description);\n    var pricing=product.pricing&&product.pricing.VND;\n    var price=pricing?Number(pricing[cycle.key]):-1;\n\n    if(title&&product.name)title.textContent=product.name;\n    if(priceBox&&Number.isFinite(price)&&price>=0){\n      priceBox.textContent=Math.round(price).toLocaleString('vi-VN')+' \u0111';\n      var suffix=document.createElement('span');\n      suffix.textContent='\/'+cycle.label;\n      priceBox.appendChild(suffix);\n    }\n    if(badgeBox&&description.badge)badgeBox.textContent=description.badge;\n    if(featureList&&description.features.length){\n      featureList.textContent='';\n      description.features.forEach(function(feature){\n        featureList.appendChild(createFeatureItem(feature));\n      });\n    }\n    if(button&&product.product_url)button.href=product.product_url;\n  }\n\n  function setupInterDataCarousel(root){\n    var track=root.querySelector('.interdata-plan-track');\n    var prev=root.querySelector('.interdata-carousel-prev');\n    var next=root.querySelector('.interdata-carousel-next');\n    if(!track||!prev||!next||track.dataset.ready==='1')return;\n    track.dataset.ready='1';\n    prev.disabled=false;\n    next.disabled=false;\n    var activePage=0;\n    var touchStartX=null;\n\n    function visibleCards(){\n      if(window.matchMedia&&window.matchMedia('(max-width:480px)').matches)return 1;\n      if(window.matchMedia&&window.matchMedia('(max-width:800px)').matches)return 2;\n      return 3;\n    }\n\n    function pageStarts(){\n      var total=track.querySelectorAll('.interdata-plan-card').length;\n      var visible=Math.min(visibleCards(),total||1);\n      var maxStart=Math.max(0,total-visible);\n      var starts=[];\n      var start=0;\n      while(start<maxStart){\n        starts.push(start);\n        start+=visible;\n      }\n      if(!starts.length||starts[starts.length-1]!==maxStart)starts.push(maxStart);\n      return starts;\n    }\n\n    function renderSlide(animate){\n      var cards=track.querySelectorAll('.interdata-plan-card');\n      var starts=pageStarts();\n      if(!cards.length||!starts.length)return;\n      if(activePage>=starts.length)activePage=starts.length-1;\n      if(activePage<0)activePage=0;\n\n      var cardWidth=cards[0].getBoundingClientRect().width;\n      var trackStyle=window.getComputedStyle?window.getComputedStyle(track):null;\n      var gap=trackStyle?parseFloat(trackStyle.columnGap||trackStyle.gap):12;\n      if(!Number.isFinite(gap))gap=12;\n      if(cardWidth<=0)return;\n\n      track.style.transition=animate?'transform .45s ease':'none';\n      track.style.transform='translate3d('+(-(cardWidth+gap)*starts[activePage])+'px,0,0)';\n      prev.setAttribute('aria-disabled',starts.length>1?'false':'true');\n      next.setAttribute('aria-disabled',starts.length>1?'false':'true');\n    }\n\n    function move(direction){\n      var starts=pageStarts();\n      if(starts.length<=1)return;\n      activePage=parseInt(root.getAttribute('data-inline-page')||activePage,10)||0;\n      activePage=(activePage+direction+starts.length)%starts.length;\n      root.setAttribute('data-inline-page',activePage);\n      renderSlide(true);\n    }\n\n    track.addEventListener('touchstart',function(event){\n      touchStartX=event.touches&&event.touches[0]?event.touches[0].clientX:null;\n    },{passive:true});\n    track.addEventListener('touchend',function(event){\n      if(touchStartX===null)return;\n      var endX=event.changedTouches&&event.changedTouches[0]?event.changedTouches[0].clientX:touchStartX;\n      var distance=endX-touchStartX;\n      touchStartX=null;\n      if(Math.abs(distance)>=40)move(distance<0?1:-1);\n    },{passive:true});\n\n    function resetAfterResize(){\n      activePage=0;\n      root.setAttribute('data-inline-page','0');\n      renderSlide(false);\n    }\n\n    window.addEventListener('resize',resetAfterResize);\n    window.addEventListener('load',resetAfterResize);\n    if('ResizeObserver' in window){\n      var resizeObserver=new ResizeObserver(function(){renderSlide(false);});\n      resizeObserver.observe(root);\n    }\n    window.requestAnimationFrame(function(){renderSlide(false);});\n    window.setTimeout(function(){renderSlide(false);},250);\n    window.setTimeout(function(){renderSlide(false);},1000);\n\n    fetchPlanData().then(function(products){\n      products.forEach(function(product){updateCardFromApi(root,product);});\n      renderSlide(false);\n    });\n  }\n\n  function initInterDataCarousels(){\n    document.querySelectorAll('[data-interdata-carousel]').forEach(setupInterDataCarousel);\n  }\n\n  if(document.readyState==='loading'){\n    document.addEventListener('DOMContentLoaded',initInterDataCarousels);\n  }else{\n    initInterDataCarousels();\n  }\n\n  if('MutationObserver' in window){\n    var initQueued=false;\n    new MutationObserver(function(){\n      if(initQueued)return;\n      initQueued=true;\n      window.requestAnimationFrame(function(){\n        initQueued=false;\n        initInterDataCarousels();\n      });\n    }).observe(document.documentElement,{childList:true,subtree:true});\n  }\n})();\n<\/script>\n\n\t<div id=\"gap-1805688311\" class=\"gap-element clearfix\" style=\"display:block; height:auto;\">\n\t\t\n<style>\n#gap-1805688311 {\n  padding-top: 15px;\n}\n<\/style>\n\t<\/div>\n\t\n<h2 id=\"section1\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">tcpdump l\u00e0 g\u00ec v\u00e0 ho\u1ea1t \u0111\u1ed9ng nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n<p><strong>tcpdump<\/strong> l\u00e0 ti\u1ec7n \u00edch ph\u00e2n t\u00edch g\u00f3i tin m\u1ea1ng (packet analyzer) ho\u1ea1t \u0111\u1ed9ng d\u01b0\u1edbi d\u1ea1ng d\u00f2ng l\u1ec7nh tr\u00ean Linux. C\u00f4ng c\u1ee5 s\u1eed d\u1ee5ng th\u01b0 vi\u1ec7n <code>libpcap<\/code> \u0111\u1ec3 ch\u1eb7n c\u00e1c khung d\u1eef li\u1ec7u \u1edf t\u1ea7ng li\u00ean k\u1ebft d\u1eef li\u1ec7u, sau \u0111\u00f3 gi\u1ea3i m\u00e3 ti\u00eau \u0111\u1ec1 v\u00e0 n\u1ed9i dung g\u00f3i tin d\u1ef1a tr\u00ean c\u01a1 ch\u1ebf l\u1ecdc g\u00f3i Berkeley Packet Filter (BPF) tr\u1ef1c ti\u1ebfp t\u1eeb nh\u00e2n Linux.<\/p>\n<p>\u0110\u1ec3 hi\u1ec3u r\u00f5 b\u1ea3n ch\u1ea5t, tcpdump can thi\u1ec7p v\u00e0o t\u1ea7ng m\u1ea1ng th\u00f4ng qua c\u00e1c th\u00e0nh ph\u1ea7n c\u1ed1t l\u00f5i:<\/p>\n<ul>\n<li><strong>Th\u01b0 vi\u1ec7n libpcap:<\/strong> Cung c\u1ea5p giao di\u1ec7n c\u1ea5p th\u1ea5p \u0111\u1ec3 t\u01b0\u01a1ng t\u00e1c v\u1edbi raw socket c\u1ee7a Linux kernel. Thay v\u00ec \u0111\u1ee3i g\u00f3i tin \u0111i qua to\u00e0n b\u1ed9 network stack \u0111\u1ec3 \u0111\u1ebfn ti\u1ebfn tr\u00ecnh \u1ee9ng d\u1ee5ng, libpcap nh\u00e2n b\u1ea3n b\u1ea3n sao c\u1ee7a g\u00f3i tin ngay khi v\u1eeba ch\u1ea1m t\u1edbi card m\u1ea1ng v\u1eadt l\u00fd ho\u1eb7c card \u1ea3o.<\/li>\n<li><strong>C\u01a1 ch\u1ebf BPF (Berkeley Packet Filter):<\/strong> B\u1ed9 m\u00e1y l\u1ecdc n\u1eb1m ngay trong kh\u00f4ng gian kernel (kernel space). Khi b\u1ea1n ch\u1ec9 \u0111\u1ecbnh \u0111i\u1ec1u ki\u1ec7n l\u1ecdc (v\u00ed d\u1ee5: ch\u1ec9 l\u1ea5y port 80), BPF lo\u1ea1i b\u1ecf c\u00e1c g\u00f3i tin kh\u00f4ng kh\u1edbp tr\u01b0\u1edbc khi sao ch\u00e9p d\u1eef li\u1ec7u l\u00ean kh\u00f4ng gian ng\u01b0\u1eddi d\u00f9ng (user space). Nh\u1edd v\u1eady, m\u00e1y ch\u1ee7 ti\u1ebft ki\u1ec7m t\u1ed1i \u0111a chu k\u1ef3 x\u1eed l\u00fd c\u1ee7a CPU v\u00e0 tr\u00e1nh tr\u00e0n b\u1ed9 nh\u1edb khi l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng qu\u00e1 l\u1edbn.<\/li>\n<li><strong>Ch\u1ebf \u0111\u1ed9 Promiscuous Mode:<\/strong> M\u1eb7c \u0111\u1ecbnh khi k\u00edch ho\u1ea1t, c\u00f4ng c\u1ee5 chuy\u1ec3n card m\u1ea1ng sang ch\u1ebf \u0111\u1ed9 nh\u1eadn to\u00e0n b\u1ed9 khung truy\u1ec1n (promiscuous mode), b\u1eaft \u0111\u01b0\u1ee3c c\u1ea3 nh\u1eefng g\u00f3i tin kh\u00f4ng g\u1eedi tr\u1ef1c ti\u1ebfp \u0111\u1ebfn \u0111\u1ecba ch\u1ec9 MAC c\u1ee7a m\u00e1y ch\u1ee7 n\u1ebfu \u0111ang k\u1ebft n\u1ed1i trong c\u00f9ng mi\u1ec1n ph\u00e1t thanh (broadcast domain).<\/li>\n<\/ul>\n<p>K\u1ef9 n\u0103ng \u0111i\u1ec1u khi\u1ec3n c\u00f4ng c\u1ee5 n\u00e0y n\u1eb1m trong nh\u00f3m <a href=\"\/blog\/cac-lenh-linux-thong-dung\/\">c\u00e1c l\u1ec7nh Linux c\u01a1 b\u1ea3n<\/a> m\u00e0 m\u1ecdi k\u1ef9 s\u01b0 h\u1ea1 t\u1ea7ng v\u00e0 qu\u1ea3n tr\u1ecb vi\u00ean h\u1ec7 th\u1ed1ng b\u1eaft bu\u1ed9c ph\u1ea3i n\u1eafm v\u1eefng khi qu\u1ea3n tr\u1ecb m\u00e1y ch\u1ee7 production.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43803\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Lenh-tcpdump.jpg\" alt=\"L\u1ec7nh tcpdump\" width=\"700\" height=\"467\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Lenh-tcpdump.jpg 1500w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Lenh-tcpdump-300x200.jpg 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Lenh-tcpdump-1024x683.jpg 1024w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Lenh-tcpdump-768x512.jpg 768w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/p>\n<div style=\"display: flex; flex-wrap: wrap; background-color: #ffffff; border: 2px solid #3B82F6; box-shadow: 0 10px 25px rgba(37,99,235,0.12); border-radius: 12px; overflow: hidden; margin: 35px 0;\">\n<p><!-- C\u1ed9t tr\u00e1i --><\/p>\n<div style=\"flex: 1; min-width: 260px; background: linear-gradient(145deg, #0F172A 0%, #1E3A8A 60%, #2563EB 100%); display: flex; align-items: center; justify-content: center; padding: 28px; text-align: center; color: #fff;\">\n<div>\n<p><span style=\"background: #10B981; color: #fff; font-size: 11.5px; font-weight: 800; text-transform: uppercase; padding: 4px 12px; border-radius: 20px; letter-spacing: 0.5px; display: inline-block; margin-bottom: 12px;\">D\u00c0NH CHO DEV &amp; SYSADMIN<\/span><\/p>\n<p style=\"color: #fff; font-size: 26px; font-family: 'Be Vietnam Pro', sans-serif; font-weight: 800; margin: 0; line-height: 1.2;\">VPS Dev &amp; Staging<\/p>\n<p style=\"color: #93c5fd; font-size: 13.5px; font-weight: 500; margin-top: 10px; line-height: 1.5;\">IPv4 Ri\u00eang \u2022 Port 10Gbps \u2022 To\u00e0n quy\u1ec1n Root OS<\/p>\n<\/div>\n<\/div>\n<p><!-- C\u1ed9t ph\u1ea3i --><\/p>\n<div style=\"flex: 2; padding: 25px 30px; min-width: 300px; display: flex; flex-direction: column; justify-content: center;\">\n<h3 style=\"font-family: 'Be Vietnam Pro', sans-serif; color: #1e3a8a; margin-top: 0; margin-bottom: 10px; font-size: 19px; font-weight: bold; line-height: 1.4;\">C\u1ea7n m\u00f4i tr\u01b0\u1eddng m\u00e1y ch\u1ee7 chu\u1ea9n \u0111\u1ec3 Test Webhook, API v\u00e0 Debug h\u1ec7 th\u1ed1ng?<\/h3>\n<p style=\"color: #4b5563; font-size: 14.5px; line-height: 1.6; margin-bottom: 18px;\">M\u1ea1ng Localhost kh\u00f4ng th\u1ec3 test \u0111\u01b0\u1ee3c Webhook hay ph\u00e2n t\u00edch g\u00f3i tin Internet th\u1ef1c t\u1ebf. H\u00e3y tri\u1ec3n khai ngay <strong>VPS Staging ri\u00eang bi\u1ec7t<\/strong> tr\u00ean n\u1ec1n SSD NVMe Enterprise. An to\u00e0n ki\u1ec3m th\u1eed, kh\u00f4ng lo \u1ea3nh h\u01b0\u1edfng Production.<\/p>\n<div><a style=\"background: linear-gradient(90deg, #2563EB 0%, #1D4ED8 100%); color: #ffffff; padding: 12px 24px; text-decoration: none; font-weight: bold; border-radius: 8px; font-size: 14.5px; display: inline-block; box-shadow: 0 4px 14px rgba(37,99,235,0.35);\" href=\"https:\/\/interdata.vn\/thue-vps\/\" target=\"_blank\" rel=\"noopener\">Kh\u1edfi T\u1ea1o VPS Staging Ngay (Ch\u1ec9 t\u1eeb v\u00e0i ngh\u00ecn\/ng\u00e0y) \u2192<\/a><br \/>\n<span style=\"display: block; font-size: 12px; color: #6b7280; margin-top: 8px;\">\u2714 C\u00e0i \u0111\u1eb7t t\u1ef1 \u0111\u1ed9ng trong 60s \u00a0\u2022\u00a0 \u2714 H\u1ed7 tr\u1ee3 \u0111a d\u1ea1ng OS (Ubuntu, AlmaLinux, Debian)<\/span><\/div>\n<\/div>\n<\/div>\n<h2 id=\"section2\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">So s\u00e1nh tcpdump, Wireshark v\u00e0 tshark: n\u00ean ch\u1ecdn c\u00f4ng c\u1ee5 n\u00e0o?<\/h2>\n<p>C\u1ea3 ba c\u00f4ng c\u1ee5 \u0111\u1ec1u ph\u1ee5c v\u1ee5 m\u1ee5c \u0111\u00edch ph\u00e2n t\u00edch m\u1ea1ng nh\u01b0ng \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf cho c\u00e1c m\u00f4i tr\u01b0\u1eddng v\u00e0 tr\u01b0\u1eddng h\u1ee3p s\u1eed d\u1ee5ng kh\u00e1c nhau. B\u1ea3ng d\u01b0\u1edbi \u0111\u00e2y \u0111\u1ed1i chi\u1ebfu chi ti\u1ebft ba c\u00f4ng c\u1ee5 ph\u1ed5 bi\u1ebfn nh\u1ea5t hi\u1ec7n nay:<\/p>\n<table style=\"width: 100%; border-collapse: collapse; margin: 25px 0; font-size: 14px; text-align: left;\">\n<thead>\n<tr style=\"background-color: #1e3a8a; color: #ffffff;\">\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">Ti\u00eau ch\u00ed<\/th>\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">tcpdump<\/th>\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">Wireshark<\/th>\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">tshark<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: bold;\">Giao di\u1ec7n<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">D\u00f2ng l\u1ec7nh (CLI) thu\u1ea7n t\u00fay<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">\u0110\u1ed3 h\u1ecda (GUI) tr\u1ef1c quan<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">D\u00f2ng l\u1ec7nh (CLI) c\u1ee7a Wireshark<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: bold;\">M\u00f4i tr\u01b0\u1eddng ch\u1ea1y<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">M\u00e1y ch\u1ee7 Linux kh\u00f4ng m\u00e0n h\u00ecnh (Headless)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">M\u00e1y tr\u1ea1m c\u00e1 nh\u00e2n (Windows, macOS, Desktop Linux)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Server ho\u1eb7c Script t\u1ef1 \u0111\u1ed9ng h\u00f3a<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: bold;\">T\u00e0i nguy\u00ean ti\u00eau t\u1ed1n<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Th\u1ea5p, footprint t\u1ed1i thi\u1ec3u<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Nhi\u1ec1u RAM khi m\u1edf file dung l\u01b0\u1ee3ng l\u1edbn<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Trung b\u00ecnh<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: bold;\">C\u00fa ph\u00e1p l\u1ecdc<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00fa ph\u00e1p BPF (host, port, net)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Display Filters (tcp.port == 80)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">H\u1ed7 tr\u1ee3 c\u1ea3 BPF v\u00e0 Display Filters<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: bold;\">Kh\u1ea3 n\u0103ng ph\u00e2n t\u00edch s\u00e2u<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u01a1 b\u1ea3n (xem header, payload th\u00f4 d\u1ea1ng Hex\/ASCII)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Chuy\u00ean s\u00e2u (Reassemble TCP stream, gi\u1ea3i m\u00e3 SSL\/TLS)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">R\u1ea5t m\u1ea1nh qua c\u00e1c tham s\u1ed1 gi\u1ea3i m\u00e3 (-z, -T)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Quy tr\u00ecnh v\u1eadn h\u00e0nh ti\u00eau chu\u1ea9n l\u00e0 d\u00f9ng <code>tcpdump<\/code> \u0111\u1ec3 b\u1eaft g\u00f3i tin v\u00e0 ghi ra t\u1ec7p tin <code>.pcap<\/code> tr\u1ef1c ti\u1ebfp tr\u00ean server t\u1eeb xa, sau \u0111\u00f3 t\u1ea3i v\u1ec1 m\u00e1y c\u00e1 nh\u00e2n m\u1edf b\u1eb1ng ph\u1ea7n m\u1ec1m <a href=\"\/blog\/wireshark-la-gi\/\">Wireshark<\/a> \u0111\u1ec3 m\u1ed5 x\u1ebb c\u1ea5u tr\u00fac lu\u1ed3ng d\u1eef li\u1ec7u.<\/p>\n<h2 id=\"section3\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">C\u00e0i \u0111\u1eb7t tcpdump tr\u00ean Linux<\/h2>\n<p>H\u1ea7u h\u1ebft c\u00e1c b\u1ea3n ph\u00e2n ph\u1ed1i Linux kh\u00f4ng c\u00e0i \u0111\u1eb7t s\u1eb5n g\u00f3i ti\u1ec7n \u00edch n\u00e0y theo m\u1eb7c \u0111\u1ecbnh. Qu\u00e1 tr\u00ecnh thi\u1ebft l\u1eadp y\u00eau c\u1ea7u ng\u01b0\u1eddi d\u00f9ng s\u1edf h\u1eefu \u0111\u1eb7c quy\u1ec1n qu\u1ea3n tr\u1ecb vi\u00ean <code>sudo<\/code> ho\u1eb7c quy\u1ec1n <code>root<\/code>. N\u1ebfu b\u1ea1n l\u00e0 ng\u01b0\u1eddi m\u1edbi l\u00e0m quen v\u1edbi m\u00e1y ch\u1ee7, h\u00e3y tham kh\u1ea3o th\u00eam b\u00e0i vi\u1ebft <a href=\"https:\/\/interdata.vn\/blog\/huong-dan-su-dung-vps\/\">h\u01b0\u1edbng d\u1eabn s\u1eed d\u1ee5ng VPS l\u1ea7n \u0111\u1ea7u<\/a> \u0111\u1ec3 n\u1eafm c\u00e1ch thi\u1ebft l\u1eadp quy\u1ec1n t\u00e0i kho\u1ea3n.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">C\u00e0i \u0111\u1eb7t tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Ubuntu v\u00e0 Debian<\/h3>\n<p>Tr\u00ean m\u00f4i tr\u01b0\u1eddng Ubuntu ho\u1eb7c Debian, b\u1ea1n c\u1eadp nh\u1eadt danh m\u1ee5c g\u00f3i v\u00e0 c\u00e0i \u0111\u1eb7t th\u00f4ng qua tr\u00ecnh qu\u1ea3n l\u00fd <code>apt<\/code>:<\/p>\n<pre><code class=\"language-bash\">sudo apt update\r\nsudo apt install tcpdump -y<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43797\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Cai-dat-tcpdump-tren-he-dieu-hanh-Ubuntu.png\" alt=\"C\u00e0i \u0111\u1eb7t tcpdump tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Ubuntu\" width=\"800\" height=\"643\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Cai-dat-tcpdump-tren-he-dieu-hanh-Ubuntu.png 885w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Cai-dat-tcpdump-tren-he-dieu-hanh-Ubuntu-300x241.png 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Cai-dat-tcpdump-tren-he-dieu-hanh-Ubuntu-768x617.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">C\u00e0i \u0111\u1eb7t tr\u00ean CentOS, AlmaLinux v\u00e0 Rocky Linux<\/h3>\n<p>\u0110\u1ed1i v\u1edbi CentOS 7, s\u1eed d\u1ee5ng tr\u00ecnh qu\u1ea3n l\u00fd <code>yum<\/code>:<\/p>\n<pre><code class=\"language-bash\">sudo yum install tcpdump -y<\/code><\/pre>\n<p>\u0110\u1ed1i v\u1edbi AlmaLinux 8\/9, Rocky Linux ho\u1eb7c RHEL hi\u1ec7n \u0111\u1ea1i, s\u1eed d\u1ee5ng tr\u00ecnh qu\u1ea3n l\u00fd <code>dnf<\/code>:<\/p>\n<pre><code class=\"language-bash\">sudo dnf install tcpdump -y<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">Ki\u1ec3m tra phi\u00ean b\u1ea3n c\u00e0i \u0111\u1eb7t th\u00e0nh c\u00f4ng<\/h3>\n<p>Sau khi ti\u1ebfn tr\u00ecnh c\u00e0i \u0111\u1eb7t ho\u00e0n t\u1ea5t, x\u00e1c minh phi\u00ean b\u1ea3n binary v\u00e0 th\u01b0 vi\u1ec7n <code>libpcap<\/code> \u0111i k\u00e8m:<\/p>\n<pre><code class=\"language-bash\">tcpdump --version<\/code><\/pre>\n<p>K\u1ebft qu\u1ea3 hi\u1ec3n th\u1ecb tr\u00ean terminal s\u1ebd t\u01b0\u01a1ng t\u1ef1 nh\u01b0 sau:<\/p>\n<pre><code class=\"language-bash\">tcpdump version 4.99.4\r\nlibpcap version 1.10.4 (with TPACKET_V3)\r\nOpenSSL 3.0.13 30 Jan 2024<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-43798\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Kiem-tra-phien-ban-tcpdump-cai-dat-thanh-cong.png\" alt=\"Ki\u1ec3m tra phi\u00ean b\u1ea3n tcpdump c\u00e0i \u0111\u1eb7t th\u00e0nh c\u00f4ng\" width=\"404\" height=\"114\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Kiem-tra-phien-ban-tcpdump-cai-dat-thanh-cong.png 404w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Kiem-tra-phien-ban-tcpdump-cai-dat-thanh-cong-300x85.png 300w\" sizes=\"auto, (max-width: 404px) 100vw, 404px\" \/><\/p>\n<h2 id=\"section4\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">C\u00e1c l\u1ec7nh tcpdump c\u01a1 b\u1ea3n c\u1ea7n bi\u1ebft khi b\u1eaft g\u00f3i tin<\/h2>\n<p>Khi th\u1ef1c hi\u1ec7n x\u1eed l\u00fd s\u1ef1 c\u1ed1 m\u1ea1ng, \u00e1p d\u1ee5ng c\u00e1c c\u1edd (flags) ch\u00ednh x\u00e1c gi\u00fap c\u00f4 l\u1eadp d\u1eef li\u1ec7u c\u1ea7n thi\u1ebft thay v\u00ec \u0111\u1ec3 m\u00e0n h\u00ecnh tr\u00e0n ng\u1eadp h\u00e0ng ngh\u00ecn d\u00f2ng th\u00f4ng tin kh\u00f4ng li\u00ean quan. B\u1ea3ng t\u1ed5ng h\u1ee3p d\u01b0\u1edbi \u0111\u00e2y li\u1ec7t k\u00ea c\u00e1c tham s\u1ed1 c\u01a1 b\u1ea3n nh\u1ea5t:<\/p>\n<table style=\"width: 100%; border-collapse: collapse; margin: 25px 0; font-size: 14px; text-align: left;\">\n<thead>\n<tr style=\"background-color: #1e3a8a; color: #ffffff;\">\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">C\u1edd (Flag)<\/th>\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">Ch\u1ee9c n\u0103ng k\u1ef9 thu\u1eadt<\/th>\n<th style=\"padding: 12px 15px; border: 1px solid #BFDBFE;\">M\u1ee5c \u0111\u00edch s\u1eed d\u1ee5ng th\u1ef1c t\u1ebf<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-D<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Li\u1ec7t k\u00ea danh s\u00e1ch network interface<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">X\u00e1c \u0111\u1ecbnh t\u00ean card m\u1ea1ng (eth0, ens3, lo)<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-i [interface]<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ch\u1ec9 \u0111\u1ecbnh interface c\u1ea7n l\u1eafng nghe<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">L\u1eafng nghe tr\u00ean card ch\u1ec9 \u0111\u1ecbnh ho\u1eb7c to\u00e0n b\u1ed9 (<code>any<\/code>)<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-n<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Kh\u00f4ng ph\u00e2n gi\u1ea3i DNS ng\u01b0\u1ee3c cho IP<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">T\u0103ng t\u1ed1c \u0111\u1ed9 hi\u1ec3n th\u1ecb, tr\u00e1nh tr\u1ec5 do DNS lookups<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-nn<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Kh\u00f4ng ph\u00e2n gi\u1ea3i c\u1ea3 t\u00ean mi\u1ec1n v\u00e0 t\u00ean port<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Hi\u1ec3n th\u1ecb s\u1ed1 hi\u1ec7u port thu\u1ea7n (v\u00ed d\u1ee5: 80 thay v\u00ec http)<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-c [s\u1ed1_l\u01b0\u1ee3ng]<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Gi\u1edbi h\u1ea1n s\u1ed1 g\u00f3i tin c\u1ea7n thu th\u1eadp<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">T\u1ef1 \u0111\u1ed9ng tho\u00e1t ti\u1ebfn tr\u00ecnh sau khi b\u1eaft \u0111\u1ee7 s\u1ed1 g\u00f3i tin<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-v \/ -vv \/ -vvv<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">T\u0103ng c\u1ea5p \u0111\u1ed9 chi ti\u1ebft (verbosity)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Xem TTL, c\u1edd TCP, ID g\u00f3i tin, checksum<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-A<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Hi\u1ec3n th\u1ecb payload d\u01b0\u1edbi \u0111\u1ecbnh d\u1ea1ng ASCII<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">\u0110\u1ecdc n\u1ed9i dung v\u0103n b\u1ea3n th\u00f4 nh\u01b0 HTTP GET\/POST, SMTP<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-X<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Hi\u1ec3n th\u1ecb c\u1ea3 m\u00e3 Hex v\u00e0 k\u00fd t\u1ef1 ASCII<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ph\u00e2n t\u00edch payload nh\u1ecb ph\u00e2n chi ti\u1ebft<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>-s0<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Thi\u1ebft l\u1eadp snapshot length b\u1eb1ng 0 (v\u00f4 h\u1ea1n)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">B\u1eaft to\u00e0n b\u1ed9 chi\u1ec1u d\u00e0i g\u00f3i tin, tr\u00e1nh b\u1ecb c\u1eaft c\u1ee5t (truncation)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">Li\u1ec7t k\u00ea c\u00e1c giao di\u1ec7n m\u1ea1ng kh\u1ea3 d\u1ee5ng<\/h3>\n<p>Tr\u01b0\u1edbc khi b\u1eaft \u0111\u1ea7u thu th\u1eadp, b\u1ea1n c\u1ea7n x\u00e1c \u0111\u1ecbnh card m\u1ea1ng \u0111ang nh\u1eadn l\u01b0u l\u01b0\u1ee3ng:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -D<\/code><\/pre>\n<p>\u0110\u1ea7u ra m\u1eabu:<\/p>\n<pre><code class=\"language-bash\">1.eth0 [Up, Running, Connected]\r\n2.any (Pseudo-device that captures on all interfaces) [Up, Running]\r\n3.lo [Up, Running, Loopback]<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43799\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Liet-ke-cac-giao-dien-mang-kha-dung-bang-tcpdump.png\" alt=\"Li\u1ec7t k\u00ea c\u00e1c giao di\u1ec7n m\u1ea1ng kh\u1ea3 d\u1ee5ng b\u1eb1ng tcpdump\" width=\"600\" height=\"342\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Liet-ke-cac-giao-dien-mang-kha-dung-bang-tcpdump.png 649w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Liet-ke-cac-giao-dien-mang-kha-dung-bang-tcpdump-300x171.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">B\u1eaft g\u00f3i tin tr\u00ean giao di\u1ec7n m\u1ea1ng x\u00e1c \u0111\u1ecbnh<\/h3>\n<p>\u0110\u1ec3 theo d\u00f5i l\u01b0u l\u01b0\u1ee3ng tr\u00ean card <code>eth0<\/code> ho\u1eb7c <code>ens3<\/code>, gi\u1edbi h\u1ea1n 10 g\u00f3i tin v\u00e0 hi\u1ec3n th\u1ecb \u0111\u1ecba ch\u1ec9 s\u1ed1 thu\u1ea7n t\u00fay:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn -c 10<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43800\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Bat-goi-tin-tren-giao-dien-mang-xac-dinh-bang-lenh-tcpdump.png\" alt=\"B\u1eaft g\u00f3i tin tr\u00ean giao di\u1ec7n m\u1ea1ng x\u00e1c \u0111\u1ecbnh b\u1eb1ng l\u1ec7nh tcpdump\" width=\"800\" height=\"236\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Bat-goi-tin-tren-giao-dien-mang-xac-dinh-bang-lenh-tcpdump.png 1242w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Bat-goi-tin-tren-giao-dien-mang-xac-dinh-bang-lenh-tcpdump-300x89.png 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Bat-goi-tin-tren-giao-dien-mang-xac-dinh-bang-lenh-tcpdump-1024x303.png 1024w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/10\/Bat-goi-tin-tren-giao-dien-mang-xac-dinh-bang-lenh-tcpdump-768x227.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">Gi\u1ea3i m\u00e3 \u0111\u1ecbnh d\u1ea1ng \u0111\u1ea7u ra c\u1ee7a tcpdump<\/h3>\n<p>M\u1ed9t d\u00f2ng nh\u1eadt k\u00fd b\u1eaft g\u00f3i tin \u0111i\u1ec3n h\u00ecnh c\u00f3 c\u1ea5u tr\u00fac sau:<\/p>\n<pre><code class=\"language-bash\">21:15:02.105432 IP 192.168.1.50.45210 &gt; 103.56.156.20.443: Flags [P.], seq 1:120, ack 1, win 502, length 119<\/code><\/pre>\n<p>\u00dd ngh\u0129a t\u1eebng tr\u01b0\u1eddng d\u1eef li\u1ec7u:<\/p>\n<ol>\n<li><strong>21:15:02.105432:<\/strong> Th\u1eddi gian g\u00f3i tin \u0111\u01b0\u1ee3c ghi nh\u1eadn (Gi\u1edd:Ph\u00fat:Gi\u00e2y.Microgi\u00e2y).<\/li>\n<li><strong>IP:<\/strong> Giao th\u1ee9c t\u1ea7ng m\u1ea1ng (IPv4).<\/li>\n<li><strong>192.168.1.50.45210:<\/strong> \u0110\u1ecba ch\u1ec9 IP ngu\u1ed3n v\u00e0 c\u1ed5ng ngu\u1ed3n (Port 45210).<\/li>\n<li><strong>103.56.156.20.443:<\/strong> \u0110\u1ecba ch\u1ec9 IP \u0111\u00edch v\u00e0 c\u1ed5ng \u0111\u00edch (Port 443 &#8211; HTTPS).<\/li>\n<li><strong>Flags [P.]:<\/strong> C\u1edd \u0111i\u1ec1u khi\u1ec3n TCP. <code>[S]<\/code> l\u00e0 SYN, <code>[.]<\/code> l\u00e0 ACK, <code>[P]<\/code> l\u00e0 PUSH, <code>[F]<\/code> l\u00e0 FIN, <code>[R]<\/code> l\u00e0 RST. C\u1ee5m <code>[P.]<\/code> ngh\u0129a l\u00e0 g\u00f3i tin mang c\u1ea3 c\u1edd PUSH v\u00e0 ACK.<\/li>\n<li><strong>seq 1:120:<\/strong> D\u1ea3i s\u1ed1 th\u1ee9 t\u1ef1 g\u00f3i tin (Sequence number) t\u1eeb byte s\u1ed1 1 \u0111\u1ebfn 120 (ch\u1ee9a 119 bytes d\u1eef li\u1ec7u).<\/li>\n<li><strong>ack 1:<\/strong> S\u1ed1 x\u00e1c nh\u1eadn (Acknowledge number) mong mu\u1ed1n nh\u1eadn ti\u1ebfp theo.<\/li>\n<li><strong>win 502:<\/strong> K\u00edch th\u01b0\u1edbc c\u1eeda s\u1ed5 nh\u1eadn (Window size) kh\u1ea3 d\u1ee5ng c\u1ee7a ph\u00eda g\u1eedi.<\/li>\n<li><strong>length 119:<\/strong> Chi\u1ec1u d\u00e0i c\u1ee7a ph\u1ea7n th\u00e2n d\u1eef li\u1ec7u (payload) t\u00ednh theo byte.<\/li>\n<\/ol>\n<p>Khi c\u1ea7n \u0111\u1ed1i chi\u1ebfu tr\u1ea1ng th\u00e1i c\u1ed5ng \u0111ang m\u1edf ho\u1eb7c c\u00e1c k\u1ebft n\u1ed1i \u0111ang ho\u1ea1t \u0111\u1ed9ng song song v\u1edbi qu\u00e1 tr\u00ecnh b\u1eaft g\u00f3i, b\u1ea1n c\u00f3 th\u1ec3 ch\u1ea1y k\u1ebft h\u1ee3p c\u00f4ng c\u1ee5 <a href=\"\/blog\/netstat-la-gi\/\">l\u1ec7nh netstat<\/a> tr\u00ean m\u1ed9t phi\u00ean terminal kh\u00e1c.<\/p>\n<h2 id=\"section5\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">B\u1ed9 l\u1ecdc tcpdump n\u00e2ng cao v\u1edbi BPF filter<\/h2>\n<p>B\u1ed9 l\u1ecdc BPF cho ph\u00e9p b\u1ea1n x\u00e2y d\u1ef1ng c\u00e1c bi\u1ec3u th\u1ee9c \u0111i\u1ec1u ki\u1ec7n logic ch\u00ednh x\u00e1c. Nh\u1edd kh\u1ea3 n\u0103ng bi\u00ean d\u1ecbch tr\u1ef1c ti\u1ebfp th\u00e0nh m\u00e3 m\u00e1y trong kernel, BPF x\u1eed l\u00fd vi\u1ec7c l\u1ecdc g\u00f3i tin v\u1edbi t\u1ed1c \u0111\u1ed9 c\u1ef1c cao, kh\u00f4ng l\u00e0m t\u1eafc ngh\u1ebdn buffer c\u1ee7a h\u1ec7 th\u1ed1ng.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">L\u1ecdc theo \u0111\u1ecba ch\u1ec9 IP ho\u1eb7c d\u1ea3i m\u1ea1ng (Subnet)<\/h3>\n<p>L\u1ecdc c\u00e1c g\u00f3i tin c\u00f3 \u0111\u1ecba ch\u1ec9 ngu\u1ed3n ho\u1eb7c \u0111\u00edch l\u00e0 m\u1ed9t host c\u1ee5 th\u1ec3:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn host 192.168.1.100<\/code><\/pre>\n<p>L\u1ecdc l\u01b0u l\u01b0\u1ee3ng theo d\u1ea3i m\u1ea1ng CIDR s\u1eed d\u1ee5ng \u0111\u1ecbnh danh <code>net<\/code>:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn net 10.0.0.0\/24<\/code><\/pre>\n<p>Ch\u1ec9 \u0111\u1ecbnh r\u00f5 h\u01b0\u1edbng d\u1eef li\u1ec7u \u0111i b\u1eb1ng ti\u1ec1n t\u1ed1 <code>src<\/code> (ngu\u1ed3n) ho\u1eb7c <code>dst<\/code> (\u0111\u00edch):<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn src net 192.168.0.0\/16 and dst host 103.56.156.20<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">L\u1ecdc theo c\u1ed5ng v\u00e0 d\u1ea3i c\u1ed5ng (Port &amp; Portrange)<\/h3>\n<p>Gi\u00e1m s\u00e1t to\u00e0n b\u1ed9 g\u00f3i tin g\u1eedi v\u00e0 nh\u1eadn qua m\u1ed9t c\u1ed5ng d\u1ecbch v\u1ee5:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn port 80<\/code><\/pre>\n<p>L\u1ecdc m\u1ed9t d\u1ea3i c\u1ed5ng li\u00ean ti\u1ebfp:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn portrange 8000-8080<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">L\u1ecdc theo giao th\u1ee9c m\u1ea1ng<\/h3>\n<p>B\u1ea1n c\u00f3 th\u1ec3 gi\u1edbi h\u1ea1n b\u1eaft c\u00e1c giao th\u1ee9c t\u1ea7ng giao v\u1eadn ho\u1eb7c giao th\u1ee9c h\u1ed7 tr\u1ee3 nh\u01b0 <code>tcp<\/code>, <code>udp<\/code>, <code>icmp<\/code>, ho\u1eb7c <code>arp<\/code>:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn icmp<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">K\u1ebft h\u1ee3p c\u00e1c to\u00e1n t\u1eed logic: AND, OR, NOT<\/h3>\n<p>Khi ki\u1ec3m tra c\u00e1c d\u1ecbch v\u1ee5 web ph\u1ee9c t\u1ea1p, ph\u1ed1i h\u1ee3p c\u00e1c to\u00e1n t\u1eed logic gi\u00fap lo\u1ea1i tr\u1eeb th\u00f4ng tin d\u01b0 th\u1eeba:<\/p>\n<pre><code class=\"language-bash\"># L\u1ecdc g\u00f3i tin web (80 ho\u1eb7c 443) nh\u01b0ng LO\u1ea0I TR\u1eea IP m\u00e1y qu\u1ea3n tr\u1ecb vi\u00ean\r\nsudo tcpdump -i eth0 -nn \"(port 80 or port 443) and not host 118.69.182.15\"<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">L\u1ecdc chuy\u00ean s\u00e2u theo c\u1edd TCP (TCP Flags) b\u1eb1ng Bitmask<\/h3>\n<p>K\u1ef9 thu\u1eadt n\u00e0y d\u00f9ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c g\u00f3i kh\u1edfi t\u1ea1o k\u1ebft n\u1ed1i ho\u1eb7c ch\u1ea5m d\u1ee9t k\u1ebft n\u1ed1i b\u1ea5t th\u01b0\u1eddng. tcpdump cho ph\u00e9p ki\u1ec3m tra c\u00e1c byte c\u1ee5 th\u1ec3 trong ti\u00eau \u0111\u1ec1 TCP:<\/p>\n<pre><code class=\"language-bash\"># B\u1eaft c\u00e1c g\u00f3i tin ch\u1ec9 mang c\u1edd TCP SYN (y\u00eau c\u1ea7u k\u1ebft n\u1ed1i m\u1edbi)\r\nsudo tcpdump -i eth0 -nn \"tcp[tcpflags] &amp; (tcp-syn) != 0 and tcp[tcpflags] &amp; (tcp-ack) == 0\"<\/code><\/pre>\n<p>L\u1ec7nh tr\u00ean tr\u00edch xu\u1ea5t byte s\u1ed1 13 trong TCP header, th\u1ef1c hi\u1ec7n ph\u00e9p to\u00e1n bit AND \u0111\u1ec3 ki\u1ec3m tra c\u1edd SYN b\u1eadt v\u00e0 c\u1edd ACK t\u1eaft. Bi\u1ec3u th\u1ee9c n\u00e0y v\u00f4 c\u00f9ng h\u1eefu \u00edch khi ki\u1ec3m tra c\u00e1c rule \u0111\u1ecbnh tuy\u1ebfn t\u01b0\u1eddng l\u1eeda v\u1edbi iptables \u0111\u1ec3 x\u00e1c nh\u1eadn g\u00f3i SYN c\u00f3 b\u1ecb drop hay kh\u00f4ng.<\/p>\n<div style=\"background: linear-gradient(135deg, #0F172A 0%, #1E3A8A 100%); border: 2px solid #60A5FA; border-radius: 12px; padding: 28px; margin: 35px 0; text-align: center; color: #ffffff; position: relative; overflow: hidden; box-shadow: 0 10px 25px rgba(15, 23, 42, 0.15);\">\n<p style=\"font-family: 'Be Vietnam Pro', sans-serif; font-size: 22px; font-weight: 800; color: #fbbf24; margin: 0 0 8px;\">Ti\u1ebft Ki\u1ec7m \u0110\u1ebfn 80% Chi Ph\u00ed VPS &amp; Cloud Server<\/p>\n<p style=\"font-size: 14.5px; color: #e0e7ff; max-width: 650px; margin: 0 auto 18px; line-height: 1.6;\">Khoan mua gi\u00e1 g\u1ed1c! Trang <strong>Canh Me<\/strong> \u0111ang ph\u00e1t h\u00e0nh c\u00e1c \u01b0u \u0111\u00e3i \u0111\u1ed9c quy\u1ec1n, c\u1ea5u h\u00ecnh RAM kh\u1ee7ng, SSD NVMe Gen4 ch\u1ec9 d\u00e0nh ri\u00eang cho \u0111\u1ed9c gi\u1ea3.<\/p>\n<p><a style=\"background: linear-gradient(90deg, #F59E0B 0%, #D97706 100%); color: #000; padding: 12px 32px; text-decoration: none; font-weight: 800; border-radius: 8px; display: inline-block; font-size: 15px; box-shadow: 0 4px 15px rgba(245, 158, 11, 0.4);\" href=\"https:\/\/interdata.vn\/canhme\/\" target=\"_blank\" rel=\"noopener\">Xem \u01afu \u0110\u00e3i T\u1ea1i Canh Me Ngay (S\u1ed1 L\u01b0\u1ee3ng C\u00f3 H\u1ea1n) \u2192<\/a><\/p>\n<\/div>\n<h2 id=\"section6\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">C\u00e1c use case th\u1ef1c t\u1ebf c\u1ee7a l\u1ec7nh tcpdump tr\u00ean VPS<\/h2>\n<p>Vi\u1ec7c v\u1eadn h\u00e0nh m\u00e1y ch\u1ee7 th\u1ef1c t\u1ebf tr\u00ean m\u00f4i tr\u01b0\u1eddng <a href=\"\/blog\/vps-la-gi\/\">VPS (Virtual Private Server)<\/a> th\u01b0\u1eddng xuy\u00ean ph\u00e1t sinh l\u1ed7i giao ti\u1ebfp gi\u1eefa c\u00e1c t\u1ea7ng d\u1ecbch v\u1ee5. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 5 k\u1ecbch b\u1ea3n th\u1ef1c t\u1ebf k\u00e8m l\u1ec7nh th\u1ef1c thi tr\u1ef1c ti\u1ebfp.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">1. B\u1eaft g\u00f3i tin HTTP\/HTTPS \u0111\u1ec3 debug \u1ee9ng d\u1ee5ng web<\/h3>\n<p>Khi API tr\u1ea3 v\u1ec1 l\u1ed7i ho\u1eb7c proxy Nginx kh\u00f4ng th\u1ec3 chuy\u1ec3n ti\u1ebfp request t\u1edbi backend Node.js hay PHP-FPM, b\u1ea1n c\u1ea7n xem r\u00f5 ti\u00eau \u0111\u1ec1 HTTP g\u1eedi l\u00ean m\u00e1y ch\u1ee7:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn -A -s 0 \"tcp port 80 and (((ip[2:2] - ((ip[0]&amp;0xf)&lt;&lt;2)) - ((tcp[12:2]&amp;0xf0)&gt;&gt;2)) != 0)\"<\/code><\/pre>\n<p>Bi\u1ec3u th\u1ee9c tr\u00ean l\u1ecdc to\u00e0n b\u1ed9 g\u00f3i tin mang t\u1ea3i tr\u1ecdng (payload) tr\u00ean c\u1ed5ng 80 v\u00e0 in d\u1eef li\u1ec7u d\u01b0\u1edbi d\u1ea1ng k\u00fd t\u1ef1 ASCII (<code>-A<\/code>). B\u1ea1n s\u1ebd th\u1ea5y r\u00f5 c\u00e1c tr\u01b0\u1eddng <code>Host<\/code>, <code>User-Agent<\/code>, <code>Cookie<\/code>, v\u00e0 ph\u01b0\u01a1ng th\u1ee9c <code>GET \/ POST<\/code> \u0111ang g\u1eedi t\u1edbi.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">2. Ph\u00e1t hi\u1ec7n t\u1ea5n c\u00f4ng DDoS v\u00e0 brute-force<\/h3>\n<p>Khi m\u00e1y ch\u1ee7 b\u1ecb qu\u00e1 t\u1ea3i CPU \u0111\u1ed9t bi\u1ebfn do l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng t\u0103ng cao, h\u00e3y ki\u1ec3m tra xem c\u00f3 hi\u1ec7n t\u01b0\u1ee3ng SYN Flood t\u1ea5n c\u00f4ng c\u1ed5ng SSH ho\u1eb7c Web hay kh\u00f4ng:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn -c 500 \"tcp[tcpflags] &amp; tcp-syn != 0\" | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -nr | head -n 10<\/code><\/pre>\n<p>L\u1ec7nh n\u00e0y b\u1eaft 500 g\u00f3i tin SYN, tr\u00edch xu\u1ea5t IP ngu\u1ed3n, \u0111\u1ebfm s\u1ed1 l\u01b0\u1ee3ng xu\u1ea5t hi\u1ec7n v\u00e0 s\u1eafp x\u1ebfp t\u1eeb cao xu\u1ed1ng th\u1ea5p. N\u1ebfu m\u1ed9t \u0111\u1ecba ch\u1ec9 IP g\u1eedi h\u00e0ng ngh\u00ecn g\u00f3i SYN trong th\u1eddi gian ng\u1eafn m\u00e0 kh\u00f4ng ho\u00e0n th\u00e0nh b\u1eaft tay 3 b\u01b0\u1edbc, b\u1ea1n c\u00f3 th\u1ec3 d\u00f9ng d\u1ecbch v\u1ee5 b\u1ea3o v\u1ec7 t\u1ef1 \u0111\u1ed9ng nh\u01b0 <a href=\"\/blog\/cai-dat-fail2ban-tren-linux\/\">Fail2ban<\/a> \u0111\u1ec3 ch\u1eb7n IP \u0111\u00f3 ngay l\u1eadp t\u1ee9c.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">3. Debug k\u1ebft n\u1ed1i c\u01a1 s\u1edf d\u1eef li\u1ec7u (MySQL \/ PostgreSQL)<\/h3>\n<p>Khi \u1ee9ng d\u1ee5ng backend b\u00e1o l\u1ed7i &#8220;Connection timed out&#8221; ho\u1eb7c &#8220;Access denied&#8221; khi k\u1ebft n\u1ed1i t\u1edbi m\u00e1y ch\u1ee7 c\u01a1 s\u1edf d\u1eef li\u1ec7u ri\u00eang bi\u1ec7t, h\u00e3y theo d\u00f5i c\u1ed5ng d\u1eef li\u1ec7u t\u01b0\u01a1ng \u1ee9ng:<\/p>\n<pre><code class=\"language-bash\"># \u0110\u1ed1i v\u1edbi MySQL \/ MariaDB (Port 3306)\r\nsudo tcpdump -i any -nn port 3306 -vv\r\n\r\n# \u0110\u1ed1i v\u1edbi PostgreSQL (Port 5432)\r\nsudo tcpdump -i any -nn port 5432 -vv<\/code><\/pre>\n<p>N\u1ebfu b\u1ea1n th\u1ea5y g\u00f3i SYN g\u1eedi \u0111i nh\u01b0ng \u0111\u1ea7u b\u00ean kia ph\u1ea3n h\u1ed3i l\u1ea1i c\u1edd <code>[R.]<\/code> (RST-ACK), ngh\u0129a l\u00e0 d\u1ecbch v\u1ee5 database ch\u01b0a kh\u1edfi ch\u1ea1y ho\u1eb7c c\u1ed5ng ch\u01b0a \u0111\u01b0\u1ee3c ph\u00e9p l\u1eafng nghe tr\u00ean interface \u0111\u00f3. N\u1ebfu ho\u00e0n to\u00e0n kh\u00f4ng c\u00f3 ph\u1ea3n h\u1ed3i, k\u1ebft n\u1ed1i \u0111ang b\u1ecb ch\u1eb7n \u1edf m\u1ee9c m\u1ea1ng.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">4. Ki\u1ec3m tra v\u00e0 x\u00e1c minh rule t\u01b0\u1eddng l\u1eeda (UFW \/ iptables)<\/h3>\n<p>Sau khi thi\u1ebft l\u1eadp c\u00e1c ch\u00ednh s\u00e1ch b\u1ea3o m\u1eadt v\u1edbi t\u01b0\u1eddng l\u1eeda <a href=\"\/blog\/cai-dat-va-cau-hinh-ufw\/\">UFW (Uncomplicated Firewall)<\/a> ho\u1eb7c <a href=\"\/blog\/huong-dan-cau-hinh-iptables-cho-vps\/\">c\u1ea5u h\u00ecnh iptables<\/a>, b\u1ea1n c\u1ea7n ki\u1ec3m tra xem g\u00f3i tin \u0111\u1ebfn c\u00f3 th\u1ef1c s\u1ef1 b\u1ecb ch\u1eb7n l\u1ea1i kh\u00f4ng:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -nn \"dst port 22 and src host 198.51.100.25\"<\/code><\/pre>\n<p>T\u1eeb m\u00e1y client c\u00f3 IP 198.51.100.25, th\u1eed k\u1ebft n\u1ed1i SSH. N\u1ebfu tcpdump hi\u1ec3n th\u1ecb g\u00f3i tin ch\u1ea1m t\u1edbi card m\u1ea1ng nh\u01b0ng kh\u00f4ng c\u00f3 g\u00f3i ph\u1ea3n h\u1ed3i \u0111i ra, rule t\u01b0\u1eddng l\u1eeda c\u1ee7a b\u1ea1n \u0111\u00e3 th\u1ef1c thi th\u00e0nh c\u00f4ng vi\u1ec7c DROP l\u01b0u l\u01b0\u1ee3ng.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">5. K\u1ebft h\u1ee3p tcpdump v\u00e0 Wireshark tr\u1ef1c ti\u1ebfp qua SSH<\/h3>\n<p>B\u1ea1n kh\u00f4ng c\u1ea7n ph\u1ea3i l\u01b0u file r\u1ed3i chuy\u1ec3n qua SFTP m\u1ed9t c\u00e1ch th\u1ee7 c\u00f4ng. K\u1ef9 s\u01b0 c\u00f3 th\u1ec3 t\u1ea1o \u0111\u01b0\u1eddng \u1ed1ng (pipe) \u0111\u1ec3 truy\u1ec1n lu\u1ed3ng d\u1eef li\u1ec7u packet th\u1eddi gian th\u1ef1c t\u1eeb VPS Linux v\u1ec1 ph\u1ea7n m\u1ec1m Wireshark c\u00e0i tr\u00ean m\u00e1y tr\u1ea1m c\u00e1 nh\u00e2n:<\/p>\n<pre><code class=\"language-bash\"># Ch\u1ea1y l\u1ec7nh n\u00e0y tr\u00ean m\u00e1y tr\u1ea1m c\u1ee7a b\u1ea1n (Linux \/ macOS terminal)\r\nssh root@103.56.156.20 \"tcpdump -s0 -U -n -w - -i eth0 not port 22\" | wireshark -k -i -<\/code><\/pre>\n<p>Gi\u1ea3i th\u00edch c\u00e1c tham s\u1ed1 trong \u0111\u01b0\u1eddng \u1ed1ng:<\/p>\n<ul>\n<li><code>-w -<\/code>: Ghi lu\u1ed3ng nh\u1ecb ph\u00e2n tr\u1ef1c ti\u1ebfp ra \u0111\u1ea7u ra chu\u1ea9n (STDOUT).<\/li>\n<li><code>-U<\/code>: Bu\u1ed9c tcpdump ghi t\u1eebng g\u00f3i tin v\u00e0o output buffer ngay khi b\u1eaft \u0111\u01b0\u1ee3c, kh\u00f4ng ch\u1edd gom \u0111\u1ea7y block.<\/li>\n<li><code>not port 22<\/code>: Lo\u1ea1i b\u1ecf l\u01b0u l\u01b0\u1ee3ng SSH c\u1ee7a ch\u00ednh phi\u00ean k\u1ebft n\u1ed1i hi\u1ec7n t\u1ea1i \u0111\u1ec3 tr\u00e1nh t\u1ea1o ra v\u00f2ng l\u1eb7p v\u00f4 t\u1eadn (packet loop).<\/li>\n<li><code>wireshark -k -i -<\/code>: Kh\u1edfi \u0111\u1ed9ng Wireshark, l\u1eafng nghe d\u1eef li\u1ec7u t\u1eeb \u0111\u1ea7u v\u00e0o chu\u1ea9n (STDIN) v\u00e0 b\u1eaft \u0111\u1ea7u ph\u00e2n t\u00edch ngay l\u1eadp t\u1ee9c.<\/li>\n<\/ul>\n<h2 id=\"section7\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">L\u01b0u v\u00e0 \u0111\u1ecdc file .pcap v\u1edbi l\u1ec7nh tcpdump<\/h2>\n<p>Khi x\u1eed l\u00fd s\u1ef1 c\u1ed1 m\u1ea1ng gi\u00e1n \u0111o\u1ea1n theo chu k\u1ef3, vi\u1ec7c quan s\u00e1t tr\u1ef1c ti\u1ebfp tr\u00ean terminal l\u00e0 b\u1ea5t kh\u1ea3 thi. Qu\u1ea3n tr\u1ecb vi\u00ean c\u1ea7n ghi l\u1ea1i to\u00e0n b\u1ed9 d\u1ea5u v\u1ebft g\u00f3i tin v\u00e0o t\u1ec7p \u0111\u1ecbnh d\u1ea1ng chu\u1ea9n <code>.pcap<\/code> \u0111\u1ec3 ph\u1ee5c v\u1ee5 \u0111i\u1ec1u tra sau n\u00e0y.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">Ghi l\u01b0u l\u01b0\u1ee3ng ra file pcap<\/h3>\n<p>S\u1eed d\u1ee5ng c\u1edd <code>-w<\/code> \u0111\u1ec3 ch\u1ec9 \u0111\u1ecbnh \u0111\u01b0\u1eddng d\u1eabn l\u01b0u tr\u1eef:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -s 0 -w \/var\/log\/traffic_capture.pcap port 80 or port 443<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">C\u01a1 ch\u1ebf xoay v\u00f2ng file (Log Rotation) \u0111\u1ec3 ch\u1ed1ng tr\u00e0n \u0111\u0129a c\u1ee9ng<\/h3>\n<p>Ch\u1ea1y tcpdump tr\u00ean h\u1ec7 th\u1ed1ng c\u00f3 l\u01b0u l\u01b0\u1ee3ng l\u1edbn r\u1ea5t d\u1ec5 l\u00e0m \u0111\u1ea7y dung l\u01b0\u1ee3ng \u1ed5 \u0111\u0129a. S\u1eed d\u1ee5ng c\u1edd <code>-C<\/code> (gi\u1edbi h\u1ea1n dung l\u01b0\u1ee3ng theo MegaByte) v\u00e0 <code>-W<\/code> (s\u1ed1 l\u01b0\u1ee3ng file t\u1ed1i \u0111a \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef v\u00f2ng l\u1eb7p):<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -s 0 -C 100 -W 5 -w \/var\/log\/capture_rolling.pcap<\/code><\/pre>\n<p>H\u1ec7 th\u1ed1ng s\u1ebd t\u1ea1o ra c\u00e1c t\u1ec7p <code>capture_rolling.pcap0<\/code>, <code>capture_rolling.pcap1<\/code> \u0111\u1ebfn <code>capture_rolling.pcap4<\/code>. Khi \u0111\u1ea1t gi\u1edbi h\u1ea1n 100MB \u1edf file cu\u1ed1i, n\u00f3 s\u1ebd t\u1ef1 \u0111\u1ed9ng ghi \u0111\u00e8 l\u1ea1i file \u0111\u1ea7u ti\u00ean.<\/p>\n<p>B\u1ea1n c\u0169ng c\u00f3 th\u1ec3 xoay v\u00f2ng t\u1ec7p tin theo chu k\u1ef3 th\u1eddi gian v\u1edbi tham s\u1ed1 <code>-G<\/code> (t\u00ednh theo gi\u00e2y). L\u1ec7nh sau t\u1ea1o t\u1ec7p m\u1edbi sau m\u1ed7i 3600 gi\u00e2y (1 gi\u1edd):<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i eth0 -s 0 -G 3600 -w \/var\/log\/traffic_%Y%m%d_%H%M%S.pcap<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">\u0110\u1ecdc l\u1ea1i file pcap v\u1edbi b\u1ed9 l\u1ecdc<\/h3>\n<p>S\u1eed d\u1ee5ng tham s\u1ed1 <code>-r<\/code> \u0111\u1ec3 \u0111\u1ecdc file \u0111\u00e3 l\u01b0u. B\u1ea1n v\u1eabn c\u00f3 th\u1ec3 \u00e1p d\u1ee5ng \u0111\u1ea7y \u0111\u1ee7 c\u00e1c b\u1ed9 l\u1ecdc BPF nh\u01b0 khi b\u1eaft tr\u1ef1c ti\u1ebfp:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -nn -r \/var\/log\/traffic_capture.pcap host 192.168.1.50 and port 443<\/code><\/pre>\n<p>Khi tr\u00edch xu\u1ea5t v\u00e0 l\u01b0u tr\u1eef file capture m\u1ea1ng, c\u1ea7n tu\u00e2n th\u1ee7 nghi\u00eam ng\u1eb7t quy tr\u00ecnh <a href=\"\/blog\/bao-mat-vps-linux\/\">b\u1ea3o m\u1eadt VPS Linux<\/a> v\u00ec payload c\u00f3 th\u1ec3 ch\u1ee9a d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m ho\u1eb7c chu\u1ed7i x\u00e1c th\u1ef1c ch\u01b0a \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a. Song song v\u1edbi vi\u1ec7c ch\u1ea9n \u0111o\u00e1n c\u1ea5p \u0111\u1ed9 g\u00f3i tin, b\u1ea1n c\u00f3 th\u1ec3 c\u00e0i \u0111\u1eb7t h\u1ec7 th\u1ed1ng gi\u00e1m s\u00e1t \u0111\u1ed3 h\u1ecda nh\u01b0 <a href=\"\/blog\/cai-dat-netdata-tren-ubuntu\/\">Netdata<\/a> \u0111\u1ec3 quan s\u00e1t l\u01b0u l\u01b0\u1ee3ng b\u0103ng th\u00f4ng t\u1ed5ng th\u1ec3 theo th\u1eddi gian th\u1ef1c.<\/p>\n<div style=\"display: flex; flex-wrap: wrap; background-color: #ffffff; border: 2px solid #2563EB; box-shadow: 0 10px 25px rgba(37,99,235,0.12); border-radius: 12px; overflow: hidden; margin: 35px 0;\">\n<p><!-- C\u1ed9t tr\u00e1i: Gi\u00e1 tr\u1ecb b\u1ea3o ch\u1ee9ng --><\/p>\n<div style=\"flex: 1; min-width: 260px; background: linear-gradient(145deg, #0F172A 0%, #1E3A8A 60%, #2563EB 100%); display: flex; align-items: center; justify-content: center; padding: 28px; text-align: center; color: #fff;\">\n<div>\n<p><span style=\"background: #10B981; color: #fff; font-size: 11px; font-weight: 800; text-transform: uppercase; padding: 4px 12px; border-radius: 20px; letter-spacing: 0.5px; display: inline-block; margin-bottom: 12px;\">H\u1ea0 T\u1ea6NG DOANH NGHI\u1ec6P<\/span><\/p>\n<p style=\"color: #fff; font-size: 26px; font-family: 'Be Vietnam Pro', sans-serif; font-weight: 800; margin: 0; line-height: 1.2;\">Cloud Server Cao C\u1ea5p<\/p>\n<p style=\"color: #93c5fd; font-size: 13.5px; font-weight: 500; margin-top: 10px; line-height: 1.5;\">Port M\u1ea1ng 10Gbps \u2022 Anti-DDoS T\u1ef1 \u0110\u1ed9ng \u2022 Cam K\u1ebft 99.99% Uptime<\/p>\n<\/div>\n<\/div>\n<p><!-- C\u1ed9t ph\u1ea3i: \u0110\u00e1nh tr\u00fang n\u1ed7i \u0111au h\u1ea1 t\u1ea7ng ch\u1eadp ch\u1eddn --><\/p>\n<div style=\"flex: 2; padding: 25px 30px; min-width: 300px; display: flex; flex-direction: column; justify-content: center;\">\n<h3 style=\"font-family: 'Be Vietnam Pro', sans-serif; color: #1e3a8a; margin-top: 0; margin-bottom: 10px; font-size: 18.5px; font-weight: bold; line-height: 1.4;\">M\u1ec7t m\u1ecfi v\u00ec server c\u0169 li\u00ean t\u1ee5c ngh\u1ebdn m\u1ea1ng, drop packet ho\u1eb7c b\u1ecb DDoS?<\/h3>\n<p style=\"color: #4b5563; font-size: 14.5px; line-height: 1.6; margin-bottom: 18px;\">\u0110\u1eebng \u0111\u1ec3 s\u1ef1 c\u1ed1 m\u1ea1ng l\u00e0m gi\u00e1n \u0111o\u1ea1n doanh thu. N\u00e2ng c\u1ea5p l\u00ean <strong>Cloud Server InterData<\/strong> v\u1edbi \u0111\u01b0\u1eddng truy\u1ec1n t\u1ed1c \u0111\u1ed9 cao kh\u00f4ng b\u00f3p b\u0103ng th\u00f4ng, ph\u1ea7n c\u1ee9ng 100% Enterprise NVMe U.2 v\u00e0 h\u1ec7 th\u1ed1ng l\u1ecdc t\u1ea5n c\u00f4ng t\u1ef1 \u0111\u1ed9ng \u0111a t\u1ea7ng.<\/p>\n<div><a style=\"background: linear-gradient(90deg, #2563EB 0%, #1D4ED8 100%); color: #ffffff; padding: 12px 24px; text-decoration: none; font-weight: bold; border-radius: 8px; font-size: 14.5px; display: inline-block; box-shadow: 0 4px 14px rgba(37,99,235,0.35);\" href=\"https:\/\/interdata.vn\/cloud-server\/\" target=\"_blank\" rel=\"noopener\">Kh\u00e1m Ph\u00e1 Gi\u1ea3i Ph\u00e1p Cloud Ch\u1ecbu T\u1ea3i Cao \u2192<\/a><br \/>\n<span style=\"display: block; font-size: 12px; color: #6b7280; margin-top: 8px;\">\u2714 H\u1ed7 tr\u1ee3 chuy\u1ec3n d\u1eef li\u1ec7u mi\u1ec5n ph\u00ed \u00a0\u2022\u00a0 \u2714 K\u1ef9 thu\u1eadt tr\u1ef1c NOC 24\/7\/365<\/span><\/div>\n<\/div>\n<\/div>\n<h2 id=\"section8\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">X\u1eed l\u00fd s\u1ef1 c\u1ed1 th\u01b0\u1eddng g\u1eb7p khi d\u00f9ng l\u1ec7nh tcpdump<\/h2>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">S\u1ef1 c\u1ed1 1: L\u1ed7i &#8220;tcpdump: command not found&#8221;<\/h3>\n<p><strong>Nguy\u00ean nh\u00e2n:<\/strong> Ti\u1ec7n \u00edch ch\u01b0a \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t trong h\u1ec7 \u0111i\u1ec1u h\u00e0nh ho\u1eb7c \u0111\u01b0\u1eddng d\u1eabn th\u1ef1c thi kh\u00f4ng n\u1eb1m trong bi\u1ebfn m\u00f4i tr\u01b0\u1eddng <code>$PATH<\/code> c\u1ee7a ng\u01b0\u1eddi d\u00f9ng hi\u1ec7n t\u1ea1i.<\/p>\n<p><strong>C\u00e1ch x\u1eed l\u00fd:<\/strong> Ki\u1ec3m tra \u0111\u01b0\u1eddng d\u1eabn c\u00e0i \u0111\u1eb7t v\u00e0 thi\u1ebft l\u1eadp l\u1ea1i g\u00f3i ti\u1ec7n \u00edch:<\/p>\n<pre><code class=\"language-bash\"># Ki\u1ec3m tra v\u1ecb tr\u00ed nh\u1ecb ph\u00e2n\r\nwhich tcpdump\r\n\r\n# N\u1ebfu kh\u00f4ng c\u00f3 ph\u1ea3n h\u1ed3i, ti\u1ebfn h\u00e0nh c\u00e0i \u0111\u1eb7t l\u1ea1i theo b\u1ea3n ph\u00e2n ph\u1ed1i\r\nsudo apt install tcpdump -y || sudo dnf install tcpdump -y<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">S\u1ef1 c\u1ed1 2: L\u1ed7i &#8220;tcpdump: eth0: No such device exists&#8221; ho\u1eb7c &#8220;no suitable device found&#8221;<\/h3>\n<p><strong>Nguy\u00ean nh\u00e2n:<\/strong> Tr\u00ean c\u00e1c phi\u00ean b\u1ea3n Linux hi\u1ec7n \u0111\u1ea1i \u00e1p d\u1ee5ng quy chu\u1ea9n \u0111\u1eb7t t\u00ean Consistent Network Device Naming, card m\u1ea1ng v\u1eadt l\u00fd ho\u1eb7c \u1ea3o h\u00f3a kh\u00f4ng c\u00f2n mang t\u00ean <code>eth0<\/code> m\u00e0 \u0111\u1ed5i th\u00e0nh <code>ens3<\/code>, <code>ens18<\/code>, <code>enp1s0<\/code>, ho\u1eb7c <code>venet0<\/code>.<\/p>\n<p><strong>C\u00e1ch x\u1eed l\u00fd:<\/strong> S\u1eed d\u1ee5ng l\u1ec7nh xem danh s\u00e1ch thi\u1ebft b\u1ecb \u0111\u1ec3 l\u1ea5y t\u00ean ch\u00ednh x\u00e1c tr\u01b0\u1edbc khi g\u00e1n v\u00e0o c\u1edd <code>-i<\/code>:<\/p>\n<pre><code class=\"language-bash\"># Li\u1ec7t k\u00ea giao di\u1ec7n qua ip command\r\nip link show\r\n\r\n# Ho\u1eb7c d\u00f9ng tr\u1ef1c ti\u1ebfp tcpdump\r\nsudo tcpdump -D\r\n\r\n# Ch\u1ea1y v\u1edbi \u0111\u00fang t\u00ean card hi\u1ec3n th\u1ecb\r\nsudo tcpdump -i ens3 -nn<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">S\u1ef1 c\u1ed1 3: L\u1ed7i &#8220;Permission denied&#8221; \/ &#8220;Operation not permitted&#8221;<\/h3>\n<p><strong>Nguy\u00ean nh\u00e2n:<\/strong> Vi\u1ec7c m\u1edf raw socket v\u00e0 \u0111\u01b0a card m\u1ea1ng v\u00e0o ch\u1ebf \u0111\u1ed9 promiscuous mode \u0111\u00f2i h\u1ecfi \u0111\u1eb7c quy\u1ec1n c\u1ea5p kernel <code>CAP_NET_RAW<\/code> v\u00e0 <code>CAP_NET_ADMIN<\/code>.<\/p>\n<p><strong>C\u00e1ch x\u1eed l\u00fd:<\/strong> Ch\u1ea1y l\u1ec7nh v\u1edbi ti\u1ec1n t\u1ed1 <code>sudo<\/code>. Trong tr\u01b0\u1eddng h\u1ee3p c\u1ea7n c\u1ea5p quy\u1ec1n ch\u1ea1y cho ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng ph\u1ea3i root m\u00e0 kh\u00f4ng mu\u1ed1n chia s\u1ebb m\u1eadt kh\u1ea9u qu\u1ea3n tr\u1ecb, g\u00e1n capability cho file nh\u1ecb ph\u00e2n:<\/p>\n<pre><code class=\"language-bash\">sudo setcap cap_net_raw,cap_net_admin=eip \/usr\/bin\/tcpdump\r\ngetcap \/usr\/bin\/tcpdump<\/code><\/pre>\n<h3 style=\"color: #1e3a8a; font-size: 19px; font-weight: 600;\">S\u1ef1 c\u1ed1 4: C\u1ea3nh b\u00e1o &#8220;packets dropped by kernel&#8221;<\/h3>\n<p><strong>Nguy\u00ean nh\u00e2n:<\/strong> Khi l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng qu\u00e1 l\u1edbn, kh\u00f4ng gian b\u1ed9 \u0111\u1ec7m (socket buffer) trong kernel d\u00e0nh cho tcpdump b\u1ecb tr\u00e0n tr\u01b0\u1edbc khi \u1ee9ng d\u1ee5ng k\u1ecbp \u0111\u1ecdc v\u00e0 hi\u1ec3n th\u1ecb ra m\u00e0n h\u00ecnh terminal.<\/p>\n<p><strong>C\u00e1ch x\u1eed l\u00fd:<\/strong> T\u0103ng k\u00edch th\u01b0\u1edbc b\u1ed9 \u0111\u1ec7m v\u1edbi c\u1edd <code>-B<\/code> (t\u00ednh theo KiB) v\u00e0 h\u1ea1n ch\u1ebf xu\u1ea5t d\u1eef li\u1ec7u th\u00f4 ra m\u00e0n h\u00ecnh:<\/p>\n<pre><code class=\"language-bash\"># T\u0103ng b\u1ed9 \u0111\u1ec7m l\u00ean 4MB (4096 KiB) v\u00e0 l\u01b0u tr\u1ef1c ti\u1ebfp ra file thay v\u00ec in ra m\u00e0n h\u00ecnh\r\nsudo tcpdump -i eth0 -B 4096 -w \/tmp\/capture_perf.pcap -n<\/code><\/pre>\n<div id=\"faq\" style=\"background-color: #f8fafc; border: 1.5px solid #E2E8F0; border-radius: 12px; padding: 30px; margin: 40px 0;\">\n<h2 style=\"color: #1e3a8a; font-size: 22px; font-weight: bold; margin-top: 0;\">C\u00e2u H\u1ecfi Th\u01b0\u1eddng G\u1eb7p v\u1ec1 L\u1ec7nh tcpdump<\/h2>\n<h3 style=\"color: #1e3a8a; font-size: 17px; font-weight: 600; margin-bottom: 8px;\">L\u1ec7nh tcpdump d\u00f9ng \u0111\u1ec3 l\u00e0m g\u00ec?<\/h3>\n<p style=\"font-size: 14.5px; color: #4b5563; line-height: 1.6; margin-top: 0;\">C\u00f4ng c\u1ee5 n\u00e0y d\u00f9ng \u0111\u1ec3 thu gi\u1eef, tr\u00edch xu\u1ea5t v\u00e0 l\u1ecdc c\u00e1c g\u00f3i tin m\u1ea1ng truy\u1ec1n qua card m\u1ea1ng m\u00e1y ch\u1ee7 Linux. Qu\u1ea3n tr\u1ecb vi\u00ean s\u1eed d\u1ee5ng ti\u1ec7n \u00edch n\u00e0y \u0111\u1ec3 x\u1eed l\u00fd s\u1ef1 c\u1ed1 k\u1ebft n\u1ed1i, ph\u00e2n t\u00edch l\u1ed7i b\u1eaft tay TCP, gi\u00e1m s\u00e1t l\u01b0u l\u01b0\u1ee3ng b\u1ea5t th\u01b0\u1eddng v\u00e0 ghi l\u1ea1i t\u1ec7p pcap ph\u1ee5c v\u1ee5 ki\u1ec3m tra an ninh m\u1ea1ng.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 17px; font-weight: 600; margin-bottom: 8px;\">tcpdump c\u00f3 c\u1ea7n quy\u1ec1n root kh\u00f4ng?<\/h3>\n<p style=\"font-size: 14.5px; color: #4b5563; line-height: 1.6; margin-top: 0;\">C\u00f3. Vi\u1ec7c m\u1edf raw socket \u0111\u1ec3 \u0111\u1ecdc c\u00e1c khung truy\u1ec1n d\u1eef li\u1ec7u v\u00e0 \u0111\u01b0a card m\u1ea1ng v\u00e0o ch\u1ebf \u0111\u1ed9 promiscuous mode \u0111\u00f2i h\u1ecfi \u0111\u1eb7c quy\u1ec1n cao nh\u1ea5t c\u1ee7a nh\u00e2n Linux. B\u1ea1n c\u1ea7n th\u1ef1c thi th\u00f4ng qua t\u00e0i kho\u1ea3n root ho\u1eb7c s\u1eed d\u1ee5ng sudo, tr\u1eeb khi \u0111\u00e3 c\u1ea5p quy\u1ec1n cap_net_raw c\u1ee5 th\u1ec3 cho t\u1ec7p nh\u1ecb ph\u00e2n.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 17px; font-weight: 600; margin-bottom: 8px;\">L\u00e0m sao \u0111\u1ec3 d\u1eebng tcpdump sau khi b\u1eaft \u0111\u1ee7 s\u1ed1 g\u00f3i tin?<\/h3>\n<p style=\"font-size: 14.5px; color: #4b5563; line-height: 1.6; margin-top: 0;\">B\u1ea1n c\u00f3 th\u1ec3 ch\u1ec9 \u0111\u1ecbnh tham s\u1ed1 -c \u0111i k\u00e8m s\u1ed1 l\u01b0\u1ee3ng g\u00f3i c\u1ea7n thu th\u1eadp \u0111\u1ec3 ti\u1ebfn tr\u00ecnh t\u1ef1 ng\u1eaft khi \u0111\u1ee7 s\u1ed1 l\u01b0\u1ee3ng, v\u00ed d\u1ee5 -c 100. N\u1ebfu \u0111ang ch\u1ea1y b\u1eaft tr\u1ef1c ti\u1ebfp m\u00e0 kh\u00f4ng g\u00e1n tham s\u1ed1 n\u00e0y, h\u00e3y nh\u1ea5n t\u1ed5 h\u1ee3p ph\u00edm Ctrl + C \u0111\u1ec3 g\u1eedi t\u00edn hi\u1ec7u ng\u1eaft SIGINT d\u1eebng ti\u1ebfn tr\u00ecnh.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 17px; font-weight: 600; margin-bottom: 8px;\">tcpdump kh\u00e1c Wireshark nh\u01b0 th\u1ebf n\u00e0o?<\/h3>\n<p style=\"font-size: 14.5px; color: #4b5563; line-height: 1.6; margin-top: 0;\">tcpdump l\u00e0 ti\u1ec7n \u00edch d\u00f2ng l\u1ec7nh g\u1ecdn nh\u1eb9, ti\u00eau th\u1ee5 r\u1ea5t \u00edt t\u00e0i nguy\u00ean v\u00e0 chuy\u00ean ch\u1ea1y tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 kh\u00f4ng c\u00f3 giao di\u1ec7n \u0111\u1ed3 h\u1ecda. Wireshark s\u1edf h\u1eefu giao di\u1ec7n ng\u01b0\u1eddi d\u00f9ng tr\u1ef1c quan, h\u1ed7 tr\u1ee3 d\u1ef1ng l\u1ea1i lu\u1ed3ng d\u1eef li\u1ec7u chuy\u00ean s\u00e2u v\u00e0 th\u00edch h\u1ee3p v\u1eadn h\u00e0nh tr\u00ean m\u00e1y t\u00ednh c\u00e1 nh\u00e2n \u0111\u1ec3 m\u1edf file pcap.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 17px; font-weight: 600; margin-bottom: 8px;\">L\u00e0m th\u1ebf n\u00e0o \u0111\u1ec3 xem file .pcap m\u00e0 kh\u00f4ng c\u1ea7n c\u00e0i Wireshark?<\/h3>\n<p style=\"font-size: 14.5px; color: #4b5563; line-height: 1.6; margin-top: 0;\">B\u1ea1n s\u1eed d\u1ee5ng tr\u1ef1c ti\u1ebfp tham s\u1ed1 -r c\u1ee7a tcpdump c\u00f9ng v\u1edbi c\u00e1c b\u1ed9 l\u1ecdc BPF \u0111\u1ec3 \u0111\u1ecdc n\u1ed9i dung file ngay tr\u00ean terminal. Ngo\u00e0i ra, b\u1ea1n c\u00f3 th\u1ec3 c\u00e0i \u0111\u1eb7t c\u00f4ng c\u1ee5 tshark ho\u1eb7c tcpflow tr\u00ean Linux \u0111\u1ec3 ph\u00e2n t\u00edch c\u1ea5u tr\u00fac lu\u1ed3ng d\u1eef li\u1ec7u m\u00e0 kh\u00f4ng c\u1ea7n m\u00f4i tr\u01b0\u1eddng giao di\u1ec7n \u0111\u1ed3 h\u1ecda.<\/p>\n<\/div>\n<div style=\"border-top: 2px dashed #BFDBFE; margin-top: 50px; padding-top: 30px;\">\n<h2 style=\"color: #1e3a8a; font-size: 22px; font-weight: bold;\">K\u1ebft lu\u1eadn: D\u00f9ng l\u1ec7nh tcpdump \u0111\u00fang c\u00e1ch \u0111\u1ec3 ch\u1ea9n \u0111o\u00e1n m\u1ea1ng nhanh h\u01a1n<\/h2>\n<p style=\"font-size: 15px; color: #374151; line-height: 1.7;\">Th\u00e0nh th\u1ea1o <strong>l\u1ec7nh tcpdump<\/strong> gi\u00fap b\u1ea1n nhanh ch\u00f3ng l\u00e0m ch\u1ee7 k\u1ef9 n\u0103ng c\u00f4 l\u1eadp l\u1ed7i m\u1ea1ng, ph\u00e2n t\u00edch h\u00e0nh vi g\u00f3i tin v\u00e0 t\u0103ng c\u01b0\u1eddng b\u1ea3o m\u1eadt h\u1ea1 t\u1ea7ng m\u00e1y ch\u1ee7 Linux. Vi\u1ec7c k\u1ebft h\u1ee3p linh ho\u1ea1t b\u1ed9 l\u1ecdc BPF, tr\u00edch xu\u1ea5t \u0111\u00fang tr\u01b0\u1eddng d\u1eef li\u1ec7u v\u00e0 l\u01b0u tr\u1eef file <code>.pcap<\/code> khoa h\u1ecdc s\u1ebd ti\u1ebft ki\u1ec7m th\u1eddi gian \u0111\u00e1ng k\u1ec3 khi v\u1eadn h\u00e0nh h\u1ec7 th\u1ed1ng th\u1ef1c t\u1ebf.<\/p>\n<p style=\"font-size: 15px; color: #374151; line-height: 1.7;\">\u0110\u1ec3 r\u00e8n luy\u1ec7n c\u00e1c c\u00e2u l\u1ec7nh th\u1ef1c t\u1ebf m\u00e0 kh\u00f4ng g\u00e2y \u1ea3nh h\u01b0\u1edfng t\u1edbi h\u1ec7 th\u1ed1ng \u0111ang ho\u1ea1t \u0111\u1ed9ng, b\u1ea1n n\u00ean chu\u1ea9n b\u1ecb m\u1ed9t m\u00e1y ch\u1ee7 th\u1eed nghi\u1ec7m ri\u00eang. H\u00e3y tham kh\u1ea3o b\u1ea3ng gi\u00e1 d\u1ecbch v\u1ee5 VPS ho\u1eb7c t\u00ecm ki\u1ebfm c\u00e1c \u01b0u \u0111\u00e3i m\u1edbi nh\u1ea5t t\u1ea1i c\u1ed5ng tin Canh Me c\u1ee7a InterData \u0111\u1ec3 b\u1eaft \u0111\u1ea7u thi\u1ebft l\u1eadp m\u00f4i tr\u01b0\u1eddng lab m\u1ea1ng c\u1ee7a ri\u00eang b\u1ea1n.<\/p>\n<\/div>\n<p style=\"text-align: justify; font-size: 13px; font-style: italic; color: #6b7280; margin-top: 30px; border-top: 1px solid #E5E7EB; padding-top: 15px;\"><em>N\u1ed9i dung mang t\u00ednh tham kh\u1ea3o. L\u1ec7nh, c\u00fa ph\u00e1p, \u0111\u01b0\u1eddng d\u1eabn file v\u00e0 t\u00f9y ch\u1ecdn c\u1ea5u h\u00ecnh c\u00f3 th\u1ec3 thay \u0111\u1ed5i theo phi\u00ean b\u1ea3n h\u1ec7 \u0111i\u1ec1u h\u00e0nh, phi\u00ean b\u1ea3n tcpdump v\u00e0 m\u00f4i tr\u01b0\u1eddng c\u1ee5 th\u1ec3. N\u00ean ki\u1ec3m th\u1eed, sao l\u01b0u d\u1eef li\u1ec7u v\u00e0 \u0111\u00e1nh gi\u00e1 r\u1ee7i ro tr\u01b0\u1edbc khi \u00e1p d\u1ee5ng l\u00ean server production.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trong qu\u1ea3n tr\u1ecb m\u00e1y ch\u1ee7, l\u1ec7nh tcpdump l\u00e0 c\u00f4ng c\u1ee5 d\u00f2ng l\u1ec7nh ti\u00eau chu\u1ea9n d\u00f9ng \u0111\u1ec3 b\u1eaft, ph\u00e2n t\u00edch v\u00e0 tr\u00edch xu\u1ea5t c\u00e1c g\u00f3i tin m\u1ea1ng truy\u1ec1n qua giao di\u1ec7n m\u1ea1ng tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh Linux. Qu\u1ea3n tr\u1ecb vi\u00ean s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 n\u00e0y \u0111\u1ec3 c\u00f4 l\u1eadp l\u1ed7i k\u1ebft n\u1ed1i \u1ee9ng d\u1ee5ng, ph\u00e1t hi\u1ec7n c\u00e1c<\/p>\n","protected":false},"author":2,"featured_media":43802,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[165],"tags":[],"class_list":["post-43791","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc-it"],"_links":{"self":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/43791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/comments?post=43791"}],"version-history":[{"count":7,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/43791\/revisions"}],"predecessor-version":[{"id":43804,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/43791\/revisions\/43804"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/media\/43802"}],"wp:attachment":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/media?parent=43791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/categories?post=43791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/tags?post=43791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}