yum install tcpdump

tcpdump -i <network interface, eg: ens33> -nnAx 'expression' (nn: ip:port, A: ascii, X 16进制和ascii）

eg:

[root@k8s-node1 ~]# tcpdump -i ens33 -nn 'icmp'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
16:18:29.849568 IP 192.168.159.135 > 192.168.159.132: ICMP echo request, id 36909, seq 1, length 64
16:18:29.849623 IP 192.168.159.132 > 192.168.159.135: ICMP echo reply, id 36909, seq 1, length 64
16:18:30.850185 IP 192.168.159.135 > 192.168.159.132: ICMP echo request, id 36909, seq 2, length 64
16:18:30.850225 IP 192.168.159.132 > 192.168.159.135: ICMP echo reply, id 36909, seq 2, length 64

[root@k8s-node1 ~]# tcpdump -i ens33 -nn 'dest host 192.168.159.135'
tcpdump: syntax error
[root@k8s-node1 ~]# tcpdump -i ens33 -nn 'dst host 192.168.159.135' 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
16:21:44.688050 IP 192.168.159.2.53 > 192.168.159.135.33407: 18436 NXDomain 0/1/0 (119)
16:21:44.696574 IP 192.168.159.2.53 > 192.168.159.135.39596: 690 1/0/0 PTR localhost. (64)
16:21:46.503880 IP 192.168.159.2.53 > 192.168.159.135.41822: 60113 1/0/0 PTR localhost. (64)
16:21:47.435254 IP 192.168.159.2.53 > 192.168.159.135.42791: 33934 ServFail 0/0/0 (20)
16:21:47.444501 IP 192.168.159.2.53 > 192.168.159.135.42121: 33934 ServFail 0/0/0 (20)
16:21:56.177021 IP 192.168.159.1 > 192.168.159.135: ICMP echo request, id 1, seq 11, length 40
16:21:57.186776 IP 192.168.159.1 > 192.168.159.135: ICMP echo request, id 1, seq 12, length 40
16:21:58.035536 IP 192.168.159.2.53 > 192.168.159.135.42967: 42641 1/0/0 PTR localhost. (64)
16:21:58.193385 IP 192.168.159.1 > 192.168.159.135: ICMP echo request, id 1, seq 13, length 40
16:21:58.849807 IP 192.168.159.2.53 > 192.168.159.135.55290: 32129 ServFail 0/0/0 (20)
16:21:58.855056 IP 192.168.159.2.53 > 192.168.159.135.41988: 32129 ServFail 0/0/0 (20)
16:21:59.199716 IP 192.168.159.1 > 192.168.159.135: ICMP echo request, id 1, seq 14, length 40

[root@k8s-node1 ~]# tcpdump -i ens33 -nn 'src host 192.168.159.135'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
16:22:49.630891 IP 192.168.159.135.41634 > 192.168.159.2.53: 27789+ A? ui.localdomain. (32)
16:22:55.449932 IP 192.168.159.135.50146 > 192.168.159.2.53: 40936+ PTR? 1.0.20.172.in-addr.arpa. (41)
16:22:55.588400 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 754791894:754791946, ack 1747553912, win 255, length 52
16:22:55.682886 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 52:104, ack 53, win 255, length 52
16:22:55.827732 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 104:156, ack 105, win 255, length 52
16:22:55.966425 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 156:208, ack 157, win 255, length 52
16:22:56.015862 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 208:260, ack 209, win 255, length 52
16:22:56.199467 IP 192.168.159.135.44520 > 192.168.159.2.53: 16301+ A? ui. (20)
16:22:56.205896 IP 192.168.159.135.46922 > 192.168.159.2.53: 16301+ A? ui. (20)
16:22:56.213089 IP 192.168.159.135.37464 > 192.168.159.2.53: 60359+ A? ui.localdomain. (32)
16:22:57.300528 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 260:312, ack 261, win 255, length 52
16:22:57.490417 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 312:364, ack 313, win 255, length 52
16:22:57.662922 IP 192.168.159.135.22 > 192.168.159.1.6745: Flags [P.], seq 364:416, ack 365, win 255, length 52