Wireshark网络分析指南：免费抓包工具详解

需积分: 10 123 浏览量更新于2024-07-23 收藏 4.47MB PDF 举报

"Wireshark用户指南，网络分析工具的使用手册，版本1.11.3-rc1-2157-gbda08a2，适用于Wireshark 1.11，由Ulf Lamping、Richard Sharpe和Ed Warnicke撰写，遵循GNU General Public License v2或更高版本的开源协议。" Wireshark用户指南是网络分析领域的权威参考资料，由Ulf Lamping、Richard Sharpe和Ed Warnicke三位作者共同编著，并且在2004年至2013年间进行了版权登记。该指南允许用户根据GNU General Public License v2或之后的版本进行复制、分发和修改。指南中的所有logo和商标均归其各自所有者所有。该文档的前言部分并未在提供的内容中列出，但通常会包含关于指南的创作目的、目标读者群体和作者的简介。据描述，该指南面向需要使用Wireshark进行网络数据包捕获和分析的人群，无论他们是网络管理员、开发者还是安全专家。在介绍章节中，Wireshark被定义为一个功能强大的免费网络抓包工具，其主要特点和功能包括： 1. **什么是Wireshark？** Wireshark是一个网络封包分析软件，设计用于实时捕获和深入分析网络流量。 - **预期用途**：它适用于故障排查、性能分析、协议开发、教育以及网络安全审计等场景。 - **特性**：包括实时捕获、离线分析、广泛支持各种网络协议、色彩编码的协议层次结构以及丰富的过滤器语言。 2. **实时捕获**：Wireshark可以从多种不同的网络媒体中实时捕获数据包，例如以太网、Wi-Fi、蓝牙等。 3. **导入导出功能**：它能够导入和导出其他捕包程序（如tcpdump）生成的数据文件，方便在不同工具间进行分析。 4. **多协议解码器**：Wireshark支持数百种网络协议的解码，涵盖了从基础的TCP/IP到更复杂的HTTP、SSL/TLS、FTP等应用层协议。 5. **开源软件**：作为开源项目，Wireshark的源代码可供查看和改进，社区的持续贡献使得其功能不断更新和增强。除此之外，指南还可能涵盖如何安装Wireshark、如何启动和停止捕获、过滤器的使用方法、解析不同协议的数据包、分析网络流量、追踪通信问题以及如何为Wireshark提供反馈等内容。对于网络分析新手和专业人士来说，这个用户指南是一份非常宝贵的资源。

Introduction

• FreeBSD

• Gentoo Linux

• HP-UX

• Mandriva Linux

• NetBSD

• OpenPKG

• Red Hat Enterprise/Fedora Linux

• rPath Linux

• Sun Solaris/i386

• Sun Solaris/Sparc

• Canonical Ubuntu

If a binary package is not available for your platform, you should download the source and try to build it.

Please report your experiences to wireshark-dev[AT]wireshark.org .

1.3. Where to get Wireshark?

You can get the latest copy of the program from the Wireshark website: http://www.wireshark.org/

download.html. The website allows you to choose from among several mirrors for downloading.

A new Wireshark version will typically become available every 4-8 months.

If you want to be notified about new Wireshark releases, you should subscribe to the wireshark-announce

mailing list. You will find more details in Section 1.6.5, “Mailing Lists”.

1.4. A brief history of Wireshark

In late 1997, Gerald Combs needed a tool for tracking down networking problems and wanted to learn

more about networking, so he started writing Ethereal (the former name of the Wireshark project) as a

way to solve both problems.

Ethereal was initially released, after several pauses in development, in July 1998 as version 0.2.0. Within

days, patches, bug reports, and words of encouragement started arriving, so Ethereal was on its way to

success.

Not long after that, Gilbert Ramirez saw its potential and contributed a low-level dissector to it.

In October, 1998, Guy Harris of Network Appliance was looking for something better than tcpview, so he

started applying patches and contributing dissectors to Ethereal.

In late 1998, Richard Sharpe, who was giving TCP/IP courses, saw its potential on such courses, and started

looking at it to see if it supported the protocols he needed. While it didn't at that point, new protocols could

be easily added. So he started contributing dissectors and contributing patches.

The list of people who have contributed to the project has become very long since then, and almost all of

them started with a protocol that they needed that Wireshark or Ethereal did not already handle. So they

copied an existing dissector and contributed the code back to the team.

Introduction

In 2006 the project moved house and re-emerged under a new name: Wireshark.

In 2008, after ten years of development, Wireshark finally arrived at version 1.0. This release was the first

deemed complete, with the minimum features implemented. Its release coincided with the first Wireshark

Developer and User Conference, called SharkFest.

1.5. Development and maintenance of

Wireshark

Wireshark was initially developed by Gerald Combs. Ongoing development and maintenance of Wireshark

is handled by the Wireshark team, a loose group of individuals who fix bugs and provide new functionality.

There have also been a large number of people who have contributed protocol dissectors to Wireshark,

and it is expected that this will continue. You can find a list of the people who have contributed code to

Wireshark by checking the about dialog box of Wireshark, or at the authors page on the Wireshark web site.

Wireshark is an open source software project, and is released under the GNU General Public License

(GPL). All source code is freely available under the GPL. You are welcome to modify Wireshark to suit

your own needs, and it would be appreciated if you contribute your improvements back to the Wireshark

team.

You gain three benefits by contributing your improvements back to the community:

• Other people who find your contributions useful will appreciate them, and you will know that you have

helped people in the same way that the developers of Wireshark have helped people.

• The developers of Wireshark might improve your changes even more, as there's always room for

improvement. Or they may implement some advanced things on top of your code, which can be useful

for yourself too.

• The maintainers and developers of Wireshark will maintain your code as well, fixing it when API

changes or other changes are made, and generally keeping it in tune with what is happening with

Wireshark. So if Wireshark is updated (which is done often), you can get a new Wireshark version from

the website and your changes will already be included without any effort for you.

The Wireshark source code and binary kits for some platforms are all available on the download page of

the Wireshark website: http://www.wireshark.org/download.html.

1.6. Reporting problems and getting help

If you have problems, or need help with Wireshark, there are several places that may be of interest to you

(well, besides this guide of course).

1.6.1. Website

You will find lots of useful information on the Wireshark homepage at http://www.wireshark.org.

1.6.2. Wiki

The Wireshark Wiki at http://wiki.wireshark.org provides a wide range of information related to Wireshark

and packet capturing in general. You will find a lot of information not part of this user's guide. For example,

Introduction

there is an explanation how to capture on a switched network, an ongoing effort to build a protocol

reference and a lot more.

And best of all, if you would like to contribute your knowledge on a specific topic (maybe a network

protocol you know well), you can edit the wiki pages by simply using your web browser.

1.6.3. Q&A Forum

The Wireshark Q and A forum at http://ask.wireshark.org offers a resource where questions and answers

come together. You have the option to search what questions were asked before and what answers were

given by people who knew about the issue. Answers are graded, so you can pick out the best ones easily.

If your issue isn't discussed before you can post one yourself.

1.6.4. FAQ

The "Frequently Asked Questions" will list often asked questions and the corresponding answers.

Read the FAQ!

Before sending any mail to the mailing lists below, be sure to read the FAQ, as it will often

answer the question(s) you might have. This will save yourself and others a lot of time (keep

in mind that a lot of people are subscribed to the mailing lists).

You will find the FAQ inside Wireshark by clicking the menu item Help/Contents and selecting the FAQ

page in the dialog shown.

An online version is available at the Wireshark website: http://www.wireshark.org/faq.html. You might

prefer this online version, as it's typically more up to date and the HTML format is easier to use.

1.6.5. Mailing Lists

There are several mailing lists of specific Wireshark topics available:

wireshark-announce This mailing list will inform you about new program releases, which usually

appear about every 4-8 weeks.

wireshark-users This list is for users of Wireshark. People post questions about building and

using Wireshark, others (hopefully) provide answers.

wireshark-dev This list is for Wireshark developers. If you want to start developing a

protocol dissector, join this list.

You can subscribe to each of these lists from the Wireshark web site: http://www.wireshark.org/lists/.

From there, you can choose which mailing list you want to subscribe to by clicking on the Subscribe/

Unsubscribe/Options button under the title of the relevant list. The links to the archives are included on

that page as well.

Tip!

You can search in the list archives to see if someone asked the same question some time

before and maybe already got an answer. That way you don't have to wait until someone

answers your question.

剩余305页未读，继续阅读

wyghf18188

粉丝: 0
资源: 3

Wireshark网络分析指南：免费抓包工具详解

wireshark-user-guide.pdf

wireshark 配置 user proto rtsp

wireshark麒麟系统安装

wireshark java_Wireshark使用

ubuntu18.04安装wireshark

虚拟机上安装wireshark

linux安装wireshark教程

ubuntu20.04安装Wireshark

wireshark wireshark抓包命令

ubantu 安装wireshark

最新资源