tcpdump后台抓包并输出给wireshark

# 先进到/tmp 目录执行，方便Filezila 传输

# 开启抓包
nohup tcpdump -i eth0 -s0 -nnA 'port 22' -w dump22.pcap &
[1] 15022

# 查询pid
ps -ef|grep tcpdump |grep -v 'grep'


# 结束抓包
kill 15022

参考

https://www.cnblogs.com/bonelee/p/6121821.html
https://www.cnblogs.com/chyingp/p/linux-command-tcpdump.html