tshark -r aa.pcap -T fields -e frame.time_relative -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len -E header=n -E separator=, -E quote=n -E occurrence=f > output.csv
tshark -nr aa.pcap -T fields -e frame.time –n
tshark -2 -R "tcp.stream eq 0" -r cc.pcap
tshark -r dd.pcap -Y "(tcp.seq ==0) || (tcp.seq == 1 && tcp.ack == 1 && tcp.len == 0)" -t ad -c3
tshark -r H:/opt/data/probe/task/result/6.pcap -Y "(tcp.seq == 0 && tcp.ack == 1 && tcp.len == 0)" -t ad -c3
./esm -d http://localhost:9204 -y "bc-sc" -n 'elastic:Sw#*d23@j3&/lL2' -c 5000 -b 5 --refresh -i=/opt/apps/dump.bin
tshark.ext -r C:\Users\Administrator\Desktop\6.pcap.pcapng -Y "(tcp.seq == 0 && tcp.flags.syn == 1 && tcp.flags.ack == 0) || (tcp.seq == 0 && tcp.flags.syn == 1 && tcp.flags.ack == 1) || (tcp.seq == 1 && tcp.flags.syn == 0 && tcp.flags.ack == 1)" -t ad -c3
kafka kraft命令
/opt/module/kafka/bin/kafka-storage.sh random-uuid
/opt/module/kafka/bin/kafka-storage.sh format -t "uuid" -c /opt/module/kafka/config/kraft/server.properties
cat /opt/module/kafka/kraft-combined-logs/meta.properties
# 启动
/opt/module/kafka/bin/kafka-server-start.sh -daemon /opt/module/kafka/config/kraft/server.properties
# 列出所有的topic
bin/kafka-topics.sh --list --bootstrap-server localhost:9092
# 查看某topic详情
bin/kafka-topics.sh --describe --bootstrap-server localhost:9092 --topic task_topic
# 查看topic对应的消息数量
/opt/module/kafka/bin/kafka-run-class.sh kafka.tools.GetOffsetShell --bootstrap-server localhost:9092 --topic topic_43.254.218.15 --time -1
# 查看消息消费情况(可根据LAG列,确认消息是否有积压)
bin/kafka-consumer-groups.sh --describe --bootstrap-server localhost:9092 --group probe_result_group
bin/kafka-consumer-groups.sh --describe --bootstrap-server localhost:9092 --group task_delivery_group
# 清除topic里面的数据
bin/kafka-topics.sh --alter --bootstrap-server localhost:9092 --topic task_topic --config retention.ms=1000
# 查看所有用户组
bin/kafka-consumer-groups.sh --bootstrap-server localhost:9092 --list
<listener>
<listener-class>com.qianxin.csda.probe.agent.commons.ServerListener</listener-class>
</listener>
./esm -s http://10.48.25.42:9204 -x 'bc-sc' -m 'elastic:Sw#*d23@j3&!^lL2' -c 5000 -q=* --refresh -o=dump.bin