批量抓包

- hosts: all
  vars:
   cap_file: packet_capture_{{ ansible_hostname }}.pcap
  tasks:
    - name: start tcpdump
      # command: /usr/sbin/tcpdump -nnvi any 'port 80' -s 0 -B 65535 -C 50M -W 100 -w /data/tmp/{{ cap_file }}
      command: /usr/sbin/tcpdump -nnvi any 'port 80' -s 0 -B 65535 -w /data/tmp/{{ cap_file }}
      async: 60
      poll: 0

    - pause: minutes=1 prompt="pause for 60 seconds or press Ctrl + c then c to continue"

    - name: kill tcpdump
      command: /usr/bin/pkill tcpdump

    - name: compress capture file
      shell: (cd /data/tmp && gzip {{ cap_file }})

    - name: copy logs to local boxes webroot
      fetch: src=/data/tmp/{{ cap_file }}.gz dest=/tmp flat=yes

    - name: remove files from server
      file: path=/data/tmp/{{ cap_file }}.gz state=absent

/usr/sbin/tcpdump -nnvi any dst 10.131.4.128 -s 0 -B 65535 -C 50M -W 100 -w /data/tmp/
tcpdump -i 1 -c 1 -nn  dst 192.168.233.1 and port 80

[- hosts: all
  vars:
   cap_file: packet_capture