# Capture only traffic to or from IP address 172.18.5.4:host 172.18.5.4# Capture traffic to or from a range of IP addresses:net 192.168.0.0/24# Capture non-HTTP and non-SMTP traffic on your server (both are equivalent):host www.example.com and not (port 80 or port 25)host www.example.com and not port 80 and not port 25# Capture traffic within a range of ports with newer versions of libpcap (0.9.1 and later):tcp portrange 1501-1549#Capture only IPv4 traffic - the shortest filter, but sometimes very useful to get rid of lower layer protocols like ARP and STP:ip# Capture only unicast traffic - useful to get rid of noise on the network if you only want to see traffic to and from your machine, not, for example, broadcast and multicast announcements:not broadcast and not multicast复制代码
display filter，在抓取一定包后进行过滤。 常见表达式
ip.dst_host == 192.168.30.103 and tcp.dstport == 80ip.addr == 10.43.54.65# is equivalent toip.src == 10.43.54.65 or ip.dst == 10.43.54.65复制代码
当然，说到了 iTerm2，不得不提到终端复用软件 ，tmux 默认配置文件在 Mac 上很别扭，你可以参考我这里的，这样 tmux 就可以像 vim 一样实现各种分屏的效果了。如果你还不知道 tmux 为何物，强烈推荐你看这个13分钟的，绝对物超所值，感谢 的分享。
终端中输入命令时，移动光标有两种方式，一个是 emacs，一个 vi，可以通过 set 命令来设置，默认的是 emacs 模式，也可以通过set -o emacs来显式设置，有如下快捷键：
ctrl + a Move cursor to beginning of line
ctrl + e Move cursor to end of line
meta + b Move cursor back one word
meta + f Move cursor forward one word
ctrl + w Cut the last word
ctrl + u Cut everything before the cursor
ctrl + k Cut everything after the cursor
ctrl + y Paste the last thing to be cut
ctrl + _ Undo
如果想使用 vi 模式，可以使用如下命令set -o vi开启。 开启vi 模式后，默认是 insert 模式，按下esc键进入命令模式。
h Move cursor left
l Move cursor right
A Move cursor to end of line and put in insert mode
0 (zero) Move cursor to beginning of line (doesn't put in insert mode)
i Put into insert mode at current position
a Put into insert mode after current position
dd Delete line (saved for pasting)
D Delete text after current cursor position (saved for pasting)
p Paste text that was deleted
j Move up through history commands
k Move down through history commands
u Undo
参考：
其他一些有用的快捷键：
Ctrl + r 搜索历史命令
!! 执行上条命令
Ctrl+x Ctrl+e 调用
~/.bashrc
Linux 一般通过~/.bashrc进行环境变量的配置，但是在 Mac 下配置后，发现根本没有效果，这是为什么呢？ 其实这是个比较基础的问题，shell有两种：登录式shell与非登录式shell，直观理解，登录(login)式shell就是在你打开shell要求你输入用户名与密码的shell，我们在使用桌面Linux时一般只在登录时接触到这种shell，等我们进入系统后，再打开的Terminal就是非登录式shell了。这两种 shell 读取配置的文件是不同的：