Wireshark新手指南：全面掌握与高级特性的使用

wireshark

需积分: 10 180 浏览量更新于2024-07-18 收藏 4.56MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源推荐

Introduction

The lists are archived

You can search in the list archives to see if someone asked the same question some time

before and maybe already got an answer. That way you don’t have to wait until someone

answers your question.

1.6.6. Reporting Problems

Note

Before reporting any problems, please make sure you have installed the latest version

of Wireshark.

When reporting problems with Wireshark please supply the following information:

1. The version number of Wireshark and the dependent libraries linked with it, such as Qt or GLib.

You can obtain this from Wireshark’s about box or the command wireshark -v.

2. Information about the platform you run Wireshark on.

3. A detailed description of your problem.

4. If you get an error/warning message, copy the text of that message (and also a few lines before

and after it, if there are some) so others may find the place where things go wrong. Please don’t

give something like: "I get a warning while doing x" as this won’t give a good idea where to look.

Don’t send large files

Do not send large files (> 1 MB) to the mailing lists. Just place a note that further data

is available on request. Large files will only annoy a lot of people on the list who are

not interested in your specific problem. If required you will be asked for further data by

the persons who really can help you.

Don’t send confidential information!

If you send capture files to the mailing lists be sure they don’t contain any sensitive or

confidential information like passwords or personally identifiable information (PII).

1.6.7. Reporting Crashes on UNIX/Linux platforms

When reporting crashes with Wireshark it is helpful if you supply the traceback information along

with the information mentioned in "Reporting Problems".

You can obtain this traceback information with the following commands on UNIX or Linux (note the

backticks):

$ gdb `whereis wireshark | cut -f2 -d: | cut -d' ' -f2` core >& backtrace.txt

backtrace

If you do not have gdb available, you will have to check out your operating system’s debugger.

Mail backtrace.txt to wireshark-dev[AT]wireshark.org.

1.6.8. Reporting Crashes on Windows platforms

The Windows distributions don’t contain the symbol files (.pdb) because they are very large. You

can download them separately at https://www.wireshark.org/download/win32/all-versions/ and https:

//www.wireshark.org/download/win64/all-versions/ .

Chapter 2. Building and Installing

Wireshark

2.1. Introduction

As with all things there must be a beginning and so it is with Wireshark. To use Wireshark you must

first install it. If you are running Windows or OS X you can download an official release at https://

www.wireshark.org/download.html, install it, and skip the rest of this chapter.

If you are running another operating system such as Linux or FreeBSD you might want to install from

source. Several Linux distributions offer Wireshark packages but they commonly ship out-of-date

versions. No other versions of UNIX ship Wireshark so far. For that reason, you will need to know

where to get the latest version of Wireshark and how to install it.

This chapter shows you how to obtain source and binary packages and how to build Wireshark from

source should you choose to do so.

The following are the general steps you would use:

1. Download the relevant package for your needs, e.g. source or binary distribution.

2. Compile the source into a binary if needed. This may involve building and/or installing other

necessary packages.

3. Install the binaries into their final destinations.

2.2. Obtaining the source and binary

distributions

You can obtain both source and binary distributions from the Wireshark web site: https://

www.wireshark.org/download.html. Select the download link and then select the desired binary or

source package.

Download all required files

If you are building Wireshark from source you will In general, unless you have already

downloaded Wireshark before, you will most likely need to download several source

packages if you are building Wireshark from source. This is covered in more detail

below.

Once you have downloaded the relevant files, you can go on to the next step.

2.3. Installing Wireshark under Windows

Windows installer names contain the platform and version. For example, Wireshark-win64-2.3.0.exe

installs Wireshark 2.3.0 for 64-bit Windows. The Wireshark installer includes WinPcap which is

required for packet capture.

Simply download the Wireshark installer from https://www.wireshark.org/download.html and execute

it. Official packages are signed by the Wireshark Foundation. You can choose to install several

optional components and select the location of the installed package. The default settings are

recommended for most users.

Building and Installing Wireshark

2.3.1. Installation Components

On the Choose Components page of the installer you can select from the following:

• Wireshark - The network protocol analyzer that we all know and mostly love.

• TShark - A command-line network protocol analyzer. If you haven’t tried it you should.

• Wireshark 1 Legacy - The old (GTK+) user interface in case you need it.

• Plugins & Extensions - Extras for the Wireshark and TShark dissection engines

• Dissector Plugins - Plugins with some extended dissections.

• Tree Statistics Plugins - Extended statistics.

• Mate - Meta Analysis and Tracing Engine - User configurable extension(s) of the display filter

engine, see https://wiki.wireshark.org/Mate for details.

• SNMP MIBs - SNMP MIBs for a more detailed SNMP dissection.

• Tools - Additional command line tools to work with capture files

• Editcap - Reads a capture file and writes some or all of the packets into another capture file.

• Text2Pcap - Reads in an ASCII hex dump and writes the data into a pcap capture file.

• Reordercap - Reorders a capture file by timestamp.

• Mergecap - Combines multiple saved capture files into a single output file.

• Capinfos - Provides information on capture files.

• Rawshark - Raw packet filter.

• User’s Guide - Local installation of the User’s Guide. The Help buttons on most dialogs will require

an internet connection to show help pages if the User’s Guide is not installed locally.

2.3.2. Additional Tasks

• Start Menu Shortcuts - Add some start menu shortcuts.

• Desktop Icon - Add a Wireshark icon to the desktop.

• Quick Launch Icon - add a Wireshark icon to the Explorer quick launch toolbar.

• Associate file extensions to Wireshark - Associate standard network trace files to Wireshark.

2.3.3. Install Location

By default Wireshark installs into %ProgramFiles%\Wireshark on 32-bit Windows and

%ProgramFiles64%\Wireshark on 64-bit Windows. This expands to C:\Program Files

\Wireshark on most systems.

2.3.4. Installing WinPcap

The Wireshark installer contains the latest WinPcap installer.

If you don’t have WinPcap installed you won’t be able to capture live network traffic but you will

still be able to open saved capture files. By default the latest version of WinPcap will be installed.

Building and Installing Wireshark

If you don’t wish to do this or if you wish to reinstall WinPcap you can check the Install WinPcap

box as needed.

For more information about WinPcap see https://www.winpcap.org/ and https://wiki.wireshark.org/

WinPcap.

2.3.5. Windows installer command line options

For special cases, there are some command line parameters available:

• /S runs the installer or uninstaller silently with default values. The silent installer will not install

WinPCap.

• /desktopicon installation of the desktop icon, =yes - force installation, =no - don’t install,

otherwise use default settings. This option can be useful for a silent installer.

• /quicklaunchicon installation of the quick launch icon, =yes - force installation, =no - don’t

install, otherwise use default settings.

• /D sets the default installation directory ($INSTDIR), overriding InstallDir and InstallDirRegKey.

It must be the last parameter used in the command line and must not contain any quotes even if

the path contains spaces.

• /NCRC disables the CRC check. We recommend against using this flag.

Example:

> Wireshark-win64-wireshark-2.0.5.exe /NCRC /S /desktopicon=yes /

quicklaunchicon=no /D=C:\Program Files\Foo

Running the installer without any parameters shows the normal interactive installer.

2.3.6. Manual WinPcap Installation

As mentioned above, the Wireshark installer takes care of installing WinPcap. The following is only

necessary if you want to use a different version than the one included in the Wireshark installer, e.g.

because a new WinPcap version was released.

Additional WinPcap versions (including newer alpha or beta releases) can be downloaded from

the main WinPcap site at https://www.winpcap.org/. The Installer for Windows supports modern

Windows operating systems.

2.3.7. Update Wireshark

By default the offical Windows package will check for new versions and notify you when they are

available. If you have the Check for updates preference disabled or if you run Wireshark in an isolated

environment you should subcribe to the wireshark-announce mailing list. See Section 1.6.5, “Mailing

Lists” for details on subscribing to this list.

New versions of Wireshark are usually released every four to six weeks. Updating Wireshark is done

the same way as installing it. Simply download and start the installer exe. A reboot is usually not

required and all your personal settings remain unchanged.

2.3.8. Update WinPcap

New versions of WinPcap are less frequently available. You will find WinPcap update instructions the

WinPcap web site at https://www.winpcap.org/. You may have to reboot your machine after installing

a new WinPcap version.

Building and Installing Wireshark

2.3.9. Uninstall Wireshark

You can uninstall Wireshark using the Programs and Features control panel. Select the "Wireshark"

entry to start the uninstallation procedure.

The Wireshark uninstaller provides several options for removal. The default is to remove the core

components but keep your personal settings and WinPcap. WinPcap is left installed by default in case

other programs need it.

2.3.10. Uninstall WinPcap

You can uninstall WinPcap independently of Wireshark using the WinPcap entry in the Programs

and Features control panel. Remember that if you uninstall WinPcap you won’t be able to capture

anything with Wireshark.

2.4. Installing Wireshark under OS X

The official OS X packages are distributed as disk images (.dmg) containing the application installer.

To install Wireshark simply open the disk image and run the enclosed installer.

The installer package includes Wireshark, its related command line utilities, and a launch daemon that

adjusts capture permissions at system startup. See the included Read me first file for more details.

2.5. Building Wireshark from source under

UNIX

Building Wireshark requires the proper build environment including a compiler and many supporting

libraries. See the Developer’s Guide at https://www.wireshark.org/docs/ for more information.

Use the following general steps to build Wireshark from source under UNIX or Linux:

1. Unpack the source from its compressed tar file. If you are using Linux or your version of UNIX

uses GNU tar you can use the following command:

$ tar xaf wireshark-2.4.5.tar.xz

In other cases you will have to use the following commands:

$ xz -d wireshark-2.4.5.tar.xz

$ tar xf wireshark-2.4.5.tar

2. Change directory to the Wireshark source directory.

$ cd wireshark-2.4.5

3. Configure your source so it will build correctly for your version of UNIX. You can do this with

the following command:

$ ./configure

If this step fails you will have to rectify the problems and rerun configure. Troubleshooting

hints are provided in Section 2.7, “Troubleshooting during the install on Unix”.

4. Build the sources.

$ make

5. Install the software in its final destination.

$ make install

剩余186页未读，继续阅读

genenralibm

粉丝: 1
资源: 3

Wireshark新手指南：全面掌握与高级特性的使用

Wireshark用户手册中文版

Wireshark详细中文版使用说明书

wireshark使用详细说明文档

wireshark使用手册

wireshark手册

wireshark使用教程用户手册(超清晰版).pdf

wireshark官方

Wireshark官网

wireshark安装linux

wireshark基本介绍和学习

Wireshark下载地址

Wireshark 如何学习

https://www.wireshark.org/download.html

wireshark使教程

wireshark官网下载

wireshark网站

kali linux学习手册pdf

tcp/udp socket调试工具下载

80211ax空口包怎么抓

交换机中怎么进行抓包的操作

最新资源