2023年7月23日发(作者：)

Wireshark–如何捕获，过滤，检查⽹络数据包？Wireshark is a popular network packet capture and analysis tool. It is previously named as Ethereal. Wireshark capturespackets from a different type of interfaces and prints them as a floating list to the screen. It also provides detailedinformation about a specific packet. Wireshark can also read already captured packets in different formats like cap ,pcap ark是⼀种流⾏的⽹络数据包捕获和分析⼯具。 它以前被称为Ethereal。 Wireshark捕获来⾃不同类型接⼝的数据包，并将它们作为浮动列表打印到屏幕。 它还提供有关特定数据包的详细信息。 Wireshark还可以读取不同格式的已捕获数据包，例如cap ， pcap等。下载并安装 (Download and Install)Wireshark is supported by a lot of platforms. Let’s install许多平台都⽀持Wireshark。 让我们安装视窗：(Windows:)For Windows operating system we need to download the wireshark installation file from the official web site. The latestversion of Wireshark can be downloaded from the following link.对于Windows操作系统，我们需要从官⽅⽹站下载wireshark安装⽂件。 可以从以下链接下载最新版本的Wireshark。Windows provides a different type of installers like 32 bit, 64 bit, portable. If we do not have required privileges to installapplication we can use portable Wireshark which do not needs s提供了不同类型的安装程序，例如32位，64位，便携式。 如果我们没有安装应⽤程序所需的特权，则可以使⽤不需要安装的便携式Wireshark。Ubuntu，Debian，Mint： (Ubuntu, Debian, Mint:)Ubuntu, Debian, Mint and other deb based distributions provide Wireshark from their official repositories. Just issue thefollowing command to install ，Debian，Mint和其他基于deb的发⾏版从其官⽅存储库中提供了Wireshark。 只需发出以下命令来安装Wireshark。$ sudo apt install wireshark-qtFedora，CentOS，RedHat： (Fedora, CentOS, RedHat:)Fedora, CentOS, and RedHat provide Wireshark package in their repositories too. In order to install Wireshark in Fedora,CentOS and RedHat issue following ，CentOS和RedHat也在其存储库中提供Wireshark软件包。 为了在Fedora中安装Wireshark，CentOS和RedHat发出以下命令。$ sudo yum install wireshark-qt选择接⼝和捕获数据包 (Select Interface and Capture Packets)One of the fundamental operation with Wireshark is selecting an interface to capture network packets. When we openWireshark we will see the following screen. Available interfaces are listed with their name current network traffic on thatinterface is shown with a simple ark的基本操作之⼀是选择⼀个接⼝来捕获⽹络数据包。 当我们打开Wireshark时，我们将看到以下屏幕。 可⽤接⼝以其名称列出，该接⼝上的当前⽹络流量以简单图形显⽰。Select Interface and Capture Packets选择接⼝和捕获数据包Here we will see that namedLocal Area Connection interface has some network traffic. By the way, Wireshark can listen toUSB interfaces too.在这⾥，我们将看到命名的Local Area Connection接⼝具有⼀些⽹络流量。 顺便说⼀下，Wireshark也可以监听USB接⼝。了解更多什么是地址解析协议(ARP)及其⼯作原理？We double click on andLocal Area Connection this will start network capture on this interface and a new screen will be openedwhere the network packets flow.双击并单击“ Local Area Connection这将在此接⼝上开始⽹络捕获，并在⽹络数据包流向的位置打开⼀个新屏幕。Select Interface and Capture Packets选择接⼝和捕获数据包显⽰特定的数据包详细信息(Show Specific Packet Details)We generally look at some specific packets to analyze. We can locate the packet we want in a simple way from the right sideof the packet flow list and click on the packet. This will show detailed packet information in the middle section where Frame,Ethernet, IP, TCP/UDP, and Application layer information provided. In the lowest and third section, we will see applicationlayer data in hex format.我们通常查看⼀些特定的数据包进⾏分析。 我们可以从数据包流列表的右侧以简单的⽅式找到所需的数据包，然后单击该数据包。 这将在中间部分显⽰详细的数据包信息，其中提供了帧，以太⽹，IP，TCP / UDP和应⽤程序层信息。 在最低和第三部分，我们将以⼗六进制格式查看应⽤程序层数据。Show Specific Packet Details显⽰特定的数据包详细信息过滤捕获的数据包(Filter Captured Packets)In a busy network, there will be a lot of packets flying around. This will make to look some packets one by one very hard ark has very powerful filtering features. We can filter captured packets according to a protocol like IP, TCP, UDP, IPaddress, Source address destination address, TCP port, mac address, DNS packet, SNMP packet etc. There are a lot ofthem. We will simply look most popular of them. We can get the whole list of supported filter expressions by clickingbuttonExpression on the left up corner. We can see the filter textbox and buttonExpression.在繁忙的⽹络中，将有很多数据包在飞来飞去。 这将使查找某些数据包变得⾮常困难。 Wireshark具有⾮常强⼤的过滤功能。 我们可以根据协议过滤捕获的数据包，例如IP，TCP，UDP，IP地址，源地址⽬标地址，TCP端⼝，mac地址，DNS数据包，SNMP数据包等。它们很多。 我们只会看起来其中最受欢迎。 通过单击左上⾓的“ Expression ”按钮，可以获取⽀持的过滤器表达式的完整列表。 我们可以看到过滤器⽂本框和按钮Expression 。Filter Captured Packets过滤捕获的数据包List of supported expressions. As we can see there are a lot of protocols like.⽀持的表达式列表。 我们可以看到有很多类似的协议。过滤ARP数据包 (Filter ARP Packets)In this example we will filter ARP packets and section or the packet list only provides ARP protocol packets. We will only usearp in the filter box.在此⽰例中，我们将过滤ARP数据包，⽽section或数据包列表仅提供ARP协议数据包。 我们将仅在过滤器框中使⽤arp 。arpFilter ARP Packets过滤ARP数据包根据⽬标IP地址过滤(Filter According To Destination IP Address)Another popular usage is filtering packet those have specified destination IP address. In this example, we will filter and onlyshow those packets which have a destination IP address is .另⼀种流⾏的⽤法是过滤具有指定⽬标IP地址的数据包。 在此⽰例中，我们将过滤并仅显⽰⽬标IP地址为.那些数据包。 == 192.168.122.1Filter According To Destination IP Address根据⽬标IP地址过滤根据源IP地址过滤(Filter According To Source IP Address)We can also filter according to source IP address too. In this example, we will filter IP source address 192.168.122.1我们也可以根据源IP地址进⾏过滤。 在此⽰例中，我们将过滤IP源地址 == 192.168.122.1Filter According To Source IP Address根据源IP地址过滤过滤DNS数据包(Filter DNS Packets)We can filter DNS packets with keyworddnsserver like below.我们可以使⽤关键字dnsserver过滤DNS数据包，如下所⽰。dnsserverFilter DNS Packets过滤DNS数据包关注TCP流(Follow TCP Stream)During a regular web page load or request, there will be some round trip to download data. If we need to inspect the wholerequest and response traffic we need to filter multiple packets. We can accomplish this by filtering according to a TCPsession or TCP stream. It is called Follow TCP Stream .在常规的⽹页加载或请求期间，将有⼀些往返下载数据。 如果我们需要检查整个请求和响应流量，则需要过滤多个数据包。 我们可以通过根据TCP会话或TCP流进⾏过滤来完成此操作。 它称为“ Follow TCP Stream 。了解更多信息如何为Tcpdump指定主机，端⼝和协议？Follow TCP Stream关注TCP流This will provide the following screen which provides the whole HTTP request and response session. We can also searchthese with bottomFind.这将提供以下屏幕，其中提供了整个HTTP请求和响应会话。 我们也可以使⽤底部的Find搜索这些。封包统计 (Packet Statistics)One of the best features is the packet statistics. We can get a lot of different type of statistics with the menuStatistics fromup. We can get the following statistical information.最好的功能之⼀是数据包统计信息。 通过向上菜单“ Statistics信息”，我们可以获得许多不同类型的统计信息。 我们可以获得以下统计信息。Endpoints终点HTTPHTTPIP知识产权Ethernet⼄太⽹路PRotocol HierarchyPRotocol层次结构Packet Statistics封包统计停⽌捕捉(Stop Capturing)We can stop capturing network packets with Wireshark with the red button in the toolbar menu.我们可以使⽤⼯具栏菜单中的红⾊按钮停⽌使⽤Wireshark捕获⽹络数据包。保存捕获的数据包 (Save Captured Packets)We can save captured files. In order to save we firstly stop live packet capture. Then from the menuFile and save or Saveas menus.我们可以保存捕获的⽂件。 为了保存，我们⾸先停⽌实时数据包捕获。 然后从菜单File并save或Save as菜单。Save Captured Packets保存捕获的数据包打开Cap，Pcap等捕获⽂件(Open Capture Files Like Cap , Pcap)We can open already saved a different type of capture formats like cap, pcap ,ngcap etc. from File menu. We can also openrecently opened capture files.我们可以从File菜单中打开已经保存的不同类型的捕获格式，例如cap，pcap，ngcap等。 我们还可以打开最近打开的捕获⽂件。Open Capture Files Like Cap , Pcap打开Cap，Pcap等捕获⽂件