Wireshark 1.11最新用户指南：解析新功能

需积分: 9 71 浏览量更新于2024-07-23 收藏 4.49MB PDF 举报

"Wireshark V1.11 最新版本手册" Wireshark是一款强大的网络封包分析软件，被广泛用于网络故障排查、网络安全分析以及协议开发等领域。本手册是针对Wireshark 1.11版本的用户指南，由Ulf Lamping、Richard Sharpe和Ed Warnicke共同编写，旨在帮助用户理解和使用该版本的新功能。在手册的前言部分，作者提到，这份文档的目的是为了提供给那些需要了解Wireshark基本操作、深入分析网络流量或解决问题的用户。它涵盖了Wireshark的各种功能，并且鼓励读者在阅读过程中提供反馈，以帮助不断改进文档的质量。手册的主体部分从介绍开始，详细阐述了Wireshark的核心功能和特性。Wireshark的主要用途包括实时捕获来自多种网络媒体的数据包、导入和导出其他捕获程序的文件，以及支持众多协议解码器。这些功能使得Wireshark成为一个全能的网络分析工具。 1.1.1. 一些预期目的： Wireshark设计用于多个场景，如网络性能监控、安全审计、教学和软件开发等。它可以帮助网络管理员检测网络问题，开发者理解网络协议的工作方式，以及安全专家查找潜在的安全漏洞。 1.1.2. 特性： Wireshark的特性包括其跨平台的能力，支持多种操作系统，如Windows、Linux和macOS。此外，它还具有强大的过滤器语言，允许用户快速定位特定类型的网络流量。 1.1.3. 实时捕获： Wireshark可以实时捕获网络上的数据包，支持各种网络接口，包括以太网、无线局域网、令牌环网络等。 1.1.4. 导入其他捕获程序的文件： Wireshark能够读取多种格式的捕获文件，如libpcap（*.pcap）和Microsoft Network Monitor（*.cap）等，方便从其他工具迁移数据。 1.1.5. 导出到其他捕获程序：同样，Wireshark也支持将捕获的数据导出为不同格式，以便在其他分析工具中进一步处理。 1.1.6. 多种协议解码器： Wireshark支持超过1000种网络协议的解码，包括TCP/IP、HTTP、FTP、SMTP、DNS等，让用户能深入理解网络通信的细节。 1.1.7. 开源软件：作为开源软件，Wireshark的源代码公开，允许社区成员参与开发和改进，确保了软件的持续更新和优化。这份手册对于初次接触Wireshark的用户以及经验丰富的网络分析师都非常有用。通过阅读，用户不仅可以学习如何使用Wireshark进行数据包捕获和分析，还可以了解如何利用其高级特性进行网络诊断和问题解决。同时，由于是最新版本的文档，它包含了许多旧版手册中未涵盖的新功能，对于保持对Wireshark最新进展的了解至关重要。

Introduction

suit your own needs, and it would be appreciated if you contribute your improvements back to the

Wireshark team.

You gain three benefits by contributing your improvements back to the community:

• Other people who find your contributions useful will appreciate them, and you will know that you

have helped people in the same way that the developers of Wireshark have helped people.

• The developers of Wireshark might improve your changes even more, as there's always room for

improvement. Or they may implement some advanced things on top of your code, which can be

useful for yourself too.

• The maintainers and developers of Wireshark will maintain your code as well, fixing it when API

changes or other changes are made, and generally keeping it in tune with what is happening with

Wireshark. So if Wireshark is updated (which is done often), you can get a new Wireshark version

from the website and your changes will already be included without any effort for you.

The Wireshark source code and binary kits for some platforms are all available on the download page

of the Wireshark website: http://www.wireshark.org/download.html.

1.6. Reporting problems and getting help

If you have problems, or need help with Wireshark, there are several places that may be of interest

to you (well, besides this guide of course).

1.6.1. Website

You will find lots of useful information on the Wireshark homepage at http://www.wireshark.org.

1.6.2. Wiki

The Wireshark Wiki at http://wiki.wireshark.org provides a wide range of information related to

Wireshark and packet capturing in general. You will find a lot of information not part of this user's

guide. For example, there is an explanation how to capture on a switched network, an ongoing effort

to build a protocol reference and a lot more.

And best of all, if you would like to contribute your knowledge on a specific topic (maybe a network

protocol you know well), you can edit the wiki pages by simply using your web browser.

1.6.3. Q&A Forum

The Wireshark Q and A forum at http://ask.wireshark.org offers a resource where questions and

answers come together. You have the option to search what questions were asked before and what

answers were given by people who knew about the issue. Answers are graded, so you can pick out the

best ones easily. If your issue isn't discussed before you can post one yourself.

1.6.4. FAQ

The "Frequently Asked Questions" will list often asked questions and the corresponding answers.

Read the FAQ!

Before sending any mail to the mailing lists below, be sure to read the FAQ, as it will

often answer the question(s) you might have. This will save yourself and others a lot of

time (keep in mind that a lot of people are subscribed to the mailing lists).

You will find the FAQ inside Wireshark by clicking the menu item Help/Contents and selecting the

FAQ page in the dialog shown.

Introduction

An online version is available at the Wireshark website: http://www.wireshark.org/faq.html. You

might prefer this online version, as it's typically more up to date and the HTML format is easier to use.

1.6.5. Mailing Lists

There are several mailing lists of specific Wireshark topics available:

wireshark-announce This mailing list will inform you about new program releases, which

usually appear about every 4-8 weeks.

wireshark-users This list is for users of Wireshark. People post questions about building

and using Wireshark, others (hopefully) provide answers.

wireshark-dev This list is for Wireshark developers. If you want to start developing a

protocol dissector, join this list.

You can subscribe to each of these lists from the Wireshark web site: http://www.wireshark.org/lists/.

From there, you can choose which mailing list you want to subscribe to by clicking on the Subscribe/

Unsubscribe/Options button under the title of the relevant list. The links to the archives are included

on that page as well.

Tip!

You can search in the list archives to see if someone asked the same question some time

before and maybe already got an answer. That way you don't have to wait until someone

answers your question.

1.6.6. Reporting Problems

Note!

Before reporting any problems, please make sure you have installed the latest version

of Wireshark.

When reporting problems with Wireshark, it is helpful if you supply the following information:

1. The version number of Wireshark and the dependent libraries linked with it, e.g. GTK+, etc. You

can obtain this from the about dialog box of Wireshark, or with the command wireshark -v.

2. Information about the platform you run Wireshark on.

3. A detailed description of your problem.

4. If you get an error/warning message, copy the text of that message (and also a few lines before and

after it, if there are some), so others may find the place where things go wrong. Please don't give

something like: "I get a warning while doing x" as this won't give a good idea where to look at.

Don't send large files!

Do not send large files (>100KB) to the mailing lists, just place a note that further data

is available on request. Large files will only annoy a lot of people on the list who are

not interested in your specific problem. If required, you will be asked for further data by

the persons who really can help you.

Don't send confidential information!

If you send captured data to the mailing lists, be sure they don't contain any sensitive or

confidential information like passwords or such.

Chapter 2. Building and Installing

Wireshark

2.1. Introduction

As with all things, there must be a beginning, and so it is with Wireshark. To use Wireshark, you must:

• Obtain a binary package for your operating system, or

• Obtain the source and build Wireshark for your operating system.

Currently, several Linux distributions ship Wireshark, but they are commonly shipping an out-of-

date version. No other versions of UNIX ship Wireshark so far, and Microsoft does not ship it with

any version of Windows. For that reason, you will need to know where to get the latest version of

Wireshark and how to install it.

This chapter shows you how to obtain source and binary packages, and how to build Wireshark from

source, should you choose to do so.

The following are the general steps you would use:

1. Download the relevant package for your needs, e.g. source or binary distribution.

2. Build the source into a binary, if you have downloaded the source.

This may involve building and/or installing other necessary packages.

3. Install the binaries into their final destinations.

2.2. Obtaining the source and binary

distributions

You can obtain both source and binary distributions from the Wireshark web site: http://

www.wireshark.org. Simply select the download link, and then select either the source package or

binary package of your choice from the mirror site closest to you.

Download all required files!

In general, unless you have already downloaded Wireshark before, you will most likely

need to download several source packages if you are building Wireshark from source.

This is covered in more detail below.

Once you have downloaded the relevant files, you can go on to the next step.

Note!

While you will find a number of binary packages available on the Wireshark web site,

you might not find one for your platform, and they often tend to be several versions

behind the current released version, as they are contributed by people who have the

platforms they are built for.

For this reason, you might want to pull down the source distribution and build it, as the

process is relatively simple.

Building and Installing Wireshark

2.3. Before you build Wireshark under UNIX

Before you build Wireshark from sources, or install a binary package, you must ensure that you have

the following other packages installed:

• GTK+, The GIMP Tool Kit.

You will also need Glib. Both can be obtained from www.gtk.org

• libpcap, the packet capture software that Wireshark uses.

You can obtain libpcap from www.tcpdump.org

Depending on your system, you may be able to install these from binaries, e.g. RPMs, or you may

need to obtain them in source code form and build them.

If you have downloaded the source for GTK+, the instructions shown in Example 2.1, “Building GTK

+ from source” may provide some help in building it:

Example 2.1. Building GTK+ from source

gzip -dc gtk+-2.21.1.tar.gz | tar xvf -

cd gtk+-2.21.1

./configure

make

make install

Note!

You may need to change the version number of GTK+ in Example 2.1, “Building GTK

+ from source” to match the version of GTK+ you have downloaded. The directory you

change to will change if the version of GTK+ changes, and in all cases, tar xvf - will

show you the name of the directory you should change to.

Note!

If you use Linux, or have GNU tar installed, you can use tar zxvf gtk+-2.21.1.tar.gz. It

is also possible to use gunzip -c or gzcat rather than gzip -dc on many UNIX systems.

Note!

If you downloaded GTK+ or any other tar file using Windows, you may find your file

called gtk+-2_21_1_tar.gz.

You should consult the GTK+ web site if any errors occur in carrying out the instructions in

Example 2.1, “Building GTK+ from source”.

If you have downloaded the source to libpcap, the general instructions shown in Example 2.2,

“Building and installing libpcap” will assist in building it. Also, if your operating system does not

support tcpdump, you might also want to download it from the tcpdump web site and install it.

Example 2.2. Building and installing libpcap

剩余291页未读，继续阅读

铅华将洗尽

粉丝: 0
资源: 7

Wireshark 1.11最新用户指南：解析新功能

Wireshark用户手册中文版

wireshark 1.11.3.0

Wireshark v2.6.2中文版本

Wireshark 1.11用户手册：全面解析网络捕获与协议分析

wireshark for mac最新版本

Wireshark抓包工具使用手册

wireshark（Ethreal）中文手册

wireshark最新实用中文手册

wireshark最新版本

Wireshark网络协议速查手册.

最新资源