---
url: https://eoht.net/esxi/openwrt/openwrt-real-time-packet-capture.md
description: >-
  介绍 OpenWrt 安装 tcpdump 后的实时抓包流程，使用 Plink 或终端将 br-lan 数据流传给
  Wireshark，便于排查局域网连接和协议问题。
---

# OpenWrt 实时抓包教程：tcpdump 数据通过 Wireshark 分析 {#openwrt-realtime-packet-capture}

## 软件准备 {#software-requirements}

### 1. Openwrt 安装 Tcpdump {#install-tcpdump-on-openwrt}

```sh
opkg update
opkg install tcpdump
```

### 2. 安装 Wireshark 和 终端工具 {#install-wireshark-and-terminal}

<Links
:grid="2"
:items="[
 {
   icon: { icon: 'simple-icons:wireshark', color: '#1679A7' },
   name: 'Wireshark',
   desc: '网络协议分析工具，可以实时捕获和分析网络数据包',
   link: 'https://www.wireshark.org/download.html'
 },
 {
   image: 'https://i.eoht.net/logo/tabby.svg',
   name: 'Tabby',
   desc: '跨平台的终端模拟器，支持 SSH、Telnet 等协议，适用于连接 Openwrt 进行抓包操作',
   link: 'https://tabby.sh/'
 }
]"
/>

## 实时抓包 {#capture-packets-in-realtime}

### 使用终端 {#capture-with-terminal}

::: tip
Windows 实测只能用 `cmd` 而不能用 `Powershell`
:::

```sh
plink.exe -batch -ssh -pw 123456 root@192.168.1.1 "tcpdump -ni br-lan -s 0 -w - not port 22" | "D:\Program Files\Wireshark\Wireshark.exe" -k -i -
```

* `-pw 123456` : Openwrt的ssh密码
* `root@192.168.1.1` : Openwrt的USER@IP
* `-ni br-lan` : Openwrt上要嗅探的网卡
* `"D:\Program Files\Wireshark\Wireshark.exe"` : Windows中Wireshark的路径