Wireshark网络分析：官方认证网络分析师学习指南

5星 · 超过95%的资源需积分: 20 52 浏览量更新于2024-07-27 7 收藏 24.49MB PDF 举报

"Wireshark Network Analysis, 2nd edition, pdf" 《Wireshark网络分析》第二版是Wireshark官方认证网络分析师学习指南，由Laura Chappell编写，她是Chappell University和Wireshark University的创始人。这本书是Wireshark Certified Network Analyst (WCNA) 认证考试的官方预备指南，适用于对网络分析有浓厚兴趣的读者。本书旨在深入解析Wireshark的强大功能，帮助读者理解网络通信的细节，并提供实用的技巧和方法来分析、诊断和解决问题。Wireshark是一款广泛使用的网络协议分析器，它允许用户捕获并查看网络流量，以便进行故障排除、性能优化和安全审计。在本书中，读者将学习如何： 1. 安装和配置Wireshark，以适应各种网络环境。 2. 理解网络协议的基础知识，包括TCP/IP、HTTP、FTP、DNS等。 3. 使用Wireshark捕获和过滤网络数据包，以关注关键通信。 4. 分析数据包内容，识别潜在的问题和异常行为。 5. 学习如何跟踪会话、解析应用层协议以及理解网络延迟的原因。 6. 掌握网络性能监控和故障排除技术。 7. 探索网络安全相关的话题，如嗅探预防、加密协议分析和恶意活动检测。 8. 准备Wireshark Certified Network Analyst的认证考试，通过实践练习和模拟测试提升技能。此外，书中还包含了大量示例和练习，帮助读者巩固所学知识，同时提供了丰富的参考资料，如Wireshark Book网站（www.wiresharkbook.com）上的补充材料和更新内容。为了批量购买折扣或用于销售推广、培训课程或其他目的，请联系Chappell University以获取更多信息。该书的10位和13位ISBN分别为1-893939-90-1和978-1-893939-90-5，所有版权归属于Protocol Analysis Institute, Inc., dba Chappell University。《Wireshark网络分析》第二版是网络专业人士和爱好者的宝贵资源，无论你是新手还是经验丰富的专家，都能从中受益匪浅，提升你的网络分析和问题解决能力。

Practice What You’ve Learned

Review Questions

Answers to Review Questions

Chapter 33: Effective Use of Command Line Tools

Understand the Power of Command-Line Tools

Use Wireshark.exe (Command-Line Launch)

Capture Traffic with Tshark

List Trace File Details with Capinfos

Edit Trace Files with Editcap

Merge Trace Files with Mergecap

Convert Text with Text2pcap

Capture Traffic with Dumpcap

Understand Rawshark

Case Study: Getting GETS and a Suspect

Summary

Practice What You’ve Learned

Review Questions

Answers to Review Questions

Appendix A: Resources on the Book Website

Video Starters

Chanalyzer Pro/Wi-Spy Recordings (.wsx Files)

MaxMind GeoIP Database Files (.dat Files)

PhoneFactor SSL/TLS Vulnerabilities Documents/Trace Files

Wireshark Customized Profiles

Practice Trace Files

List of Tips

Download the Supplements from

www.wiresharkbook.com

Wireshark is Constantly Changing

Avoid Prison Time

Get Notified of New Wireshark Releases

Access the Wireshark Developer Guide

No Interface? No Capture!

Avoid File | Merge Issues

Frames vs. Packets

Overloading HTTP Object Export

Use Packet Marking to Identify Interesting Packets

Use the Perfect Time Display Format for Troubleshooting

Don’t Let Wireshark Flood a DNS Server

Editing Wireshark’s

Services

File is OK, but…

Compare Packets with Side-by-Side Views

Practice Jumping Between Corresponding Packets

See Packet Counts Without Capturing Anything

Disabling a Protocol May Blind You

Reassemble Streams for Faster Interpretations

When Wireshark Doesn’t Recognize RTP Traffic

Learn Where Your Wireshark Components Reside

The Packet Number Never Changes

Don’t Kill Wireshark Performance

Easily Resolve a Single IP Address

Get Notified When New Wireshark Versions are Released

Hubs are Only a Half-Duplex Option

Watch Timestamp Issues on Multiple NIC Captures

Cheating on Your Spanning [Contributor: Jim Aragon]

Monitor Mode Blocks Other Connectivity

Toggle Capture Interface Information to IPv4 Addresses

Experiment with Remote Capture Traffic

Select Multiple Criteria for Capture Stop

Easily Remove Duplicate Packets in Your Capture

Understand Why There are Checksum Errors on YOUR Traffic Only

Wireshark Says "Where," but Not Always "Why"

Use Capture Filters Sparingly and Display Filters Generously

Avoid host Capture Filters with Web Browsing Sessions

When to Use MAC Capture Filters Instead of IP Address Filters

Make Wireshark More Efficient

Add a TCP Window Size Field Column to Spot Problems

Be Careful when Hiding Interfaces

Network Name Resolution Can Slow Wireshark to a Crawl

Warnings about Using a Special Wireshark

hosts

File

Warnings about SNMP Object Dissection Support

Use New Filter Expression Buttons for Faster Troubleshooting

Checksum Validation Settings

Checksum Errors and Coloring Rules

Coloring Rules are Processed in Order Top to Bottom

Use Packet Marking to Save Non-Contiguous Packets

Handshakes Provide a Nice Snapshot of Latency

Characterize All Protocols and Applications Used by a Host

Database Communications are Weird Interesting!

ARP Packets Do Not Match IP Address Filters

Use Flow Graphs to Spot Web Browsing Issues

Use Your Display Filters in Command Line Capture

How to Ensure Your Display Filter is Saved

Understand Wireshark Warnings on Using

Add an

Inclusion

Field with

Exclusion

Field Filters

Consider VLC Player to Play Back Exported Video Files

Create from a

Master Profile

First

Be Careful Sharing Profiles

Import Some Profiles

Avoid the "Needle in the Haystack Issue" by Saving Subsets

Print Packet Summaries in Landscape Mode

Use Your Own Screen Capture Utility

Check out Cascade Pilot™ for Graphing

Check Expert Notes AND Warnings

Always Double-Check Expert Findings

Use a tcp.analysis.flags Filter Expression Button

What Makes an Item a Warning vs. a Note?

When to Consider Trashing a Trace File

Window Update Packets Were Colorized Incorrectly (prior to Wireshark 1.8)

Disable Wireshark’s Expert Feature… with Caution

Use the Best TCP Setting for Analyzing HTTP Traffic

Quickly Detect DNS Errors

ARP is Local Only

Watch Out for Proxy ARP

Use the IP ID Field to Spot Looping Packets

Microsoft Changed Their IPv6 SLAAC Default Setting

IPv6 Address Sanitization

Measure Round Trip Time Using an ICMP Filter

You Should Know About Jon Postel

Extending ICMP

FIN Doesn’t Mean "Shut Up"

Follow Along with the Trace File

Move Wireshark Around when Packet Loss is Identified

Send Buffers and Application Limitation Issues

The TCP Window Size > Zero Can Still Stop Data Transfer

Watch for SYN/ACKs After a Full Handshake

Filter on the TCP Flags Summary Line

Watch Out for Altered Options

Watch Out for Bytes in Flight Values During SACK

Use Wireshark's TCP Timestamp for Troubleshooting

Empty Graphs May Indicate You Selected the Wrong Packet

Red is Bad, Green is Good—Using Color Assumptions

Consider Using a Logarithmic Scale on Your IO Graph

Use the IO Graph to Prioritize Your Troubleshooting Focus

Understand and Plot TCP Packet Loss Recovery Processes

Use Capinfos –S Setting to Time-Shift Trace Files

Screen Capture those TCP Time-Sequence Graphs

The Time-Sequence Graph Reigns Supreme

Using tcp.analysis.rtt vs. tcp.time_delta

Disable Stream Reassembly to See HTTP More Clearly

Watch Out For Cache-Loaded Web Pages

Don’t Troubleshoot Large Delays before FIN or Reset Packets

Don’t Use the http Filter to Analyze Web Browsing

Create a Flow Graph to Spot Web Site Dependencies

Follow Along with an HTTPS Handshake Analysis

Delays Before Encrypted Alerts May be OK

Is There a Worm in the Trace File?

Rule Out the Wired Network to Point to the WLAN

Get Help Setting Up WLAN Capture

The Missing Details Button

Let Wireshark Resolve WLAN Decryption Key Conflicts

Put Most Often Used Decryption Keys on Top of the Key List

Use a Radiotap or PPI Header to Filter on WLAN Channels

Translate WLAN Type/Subtype Values to Hex for Easy Filtering

Filter on a Conversation Before Sorting the Time Column

Beware of frame.time_delta_displayed

Use Packet Marking to Speed Up Your Troubleshooting

Use a tcp.len Column to Easily See Payload Size

4 NOPS Expert Warning

Use Nmap on Your Network (with Permission)

Watch for Microsoft-Limited Connection Attempts

Don’t Create a Black Hole

Generate Your HTTP UserAgent Value

You Need to Order the Nmap Book… Now!

Anyone Can Spoof a MAC Address!

Filter on Upper OR Lower Case Characters

Filter on the Macof Signature

Catch the Traffic When You Run Malicious Tools

Add Wireshark to Your Path

View Numerous Statistics with One Tshark Command Line

Use Editcap to Split a Large Trace into File Sets

Merge Traces to Compare Them Side by Side in an IO Graph

Foreword by Gerald Combs, Creator of Wireshark

Wireshark was created to answer a question: "What's on my network?"

As our society relies more and more on network connectivity this question has increased in importance. You

can't effectively manage, troubleshoot, and secure a network if you don't know what it's doing at a

fundamental level. That's why it's important for you (yes, you!) to be well-versed in protocol analysis.

Fortunately there's help.

Wireshark has a large ecosystem of users, developers, educators, and companies dedicated to finding out

exactly what's happening on the network. Professionals in every branch of networking have contributed code

and ideas to Wireshark to make it work better in their environment. I am continually amazed by their talent,

wisdom, and skill.

Laura is a vital part of this ecosystem. She is the best instructor I've ever met. Each time I've had the

opportunity to see her teach I've been impressed with her ability to convey the most arcane technical details in

an easy-going, down-to-earth way. She has a unique talent for making protocol analysis accessible and fun.

This book reflects her knack for presenting packet analysis in an accessible way while at the same time

inspiring the excitement and thrill of discovery from finding out how your network really works. It's also

comprehensive, which is readily apparent if you try to lift a paper copy.

My heartfelt thanks go to Laura for her integral part in building Wireshark's user community and for being such

a great friend.

Preface

Wireshark is a FIRST RESPONDER tool that should be employed immediately when the cries of "the network is

slow" or "I think my computer is infected" echo through the company halls.

In the first case, you are using Wireshark to quickly identify the cause of performance issues. In the second

case you are using network forensics to look for evidence of a security breach. In both cases you are looking

for signatures in the traffic or packets—the ultimate purpose being isolation of unusual or unacceptable

patterns.

I’ve used the phrase "the packets never lie" for years now. It is true.

Twenty years ago I presented a session on ARCnet communications to a group of peer instructors. I delved

into the idea of packet structure and the mythical belief at that time that everyone cared. Somehow though, I

related the ARCnet networking rules and limitations to Sister Gerald, the militant no-nonsense nun who was

the head of discipline at my Catholic boarding school… and I got a few laughs. Imagine that… networking can

be funny!

Now—before you think I’m going to mention any of the other nuns, my techno-challenged father, my WoW-

addicted son (go Alliance!), my iPhone toting daughter (who I hope will grow up and make iTunes a less

pathetic application) and my Pavlovian response to a trace file filled with hideous communications issues and

delicious security flaws—this book is not a breezy stroll through the world of packets.

This book is packed with basic through advanced techniques, tips and tricks to analyze a variety of network

types. It is designed to get you from point A to point Z (or perhaps I should say point 0x00 to point 0xFF) as

fast as possible with a solid understanding of the processes, protocols, and putrid things that occur under our

noses (or under our feet or over our heads).

If you don’t have Wireshark loaded on every computer within reach, stop now! Wireshark is the best

girlfriend/boyfriend, wife/husband, mother/father, sister/brother, dog/cat or lover your network will ever have.

Who is always there to listen to you with a patient and understanding silence when you are crying in your latte

because the users keep complaining about network performance?

Wireshark

Who never threatens to fire you if you don’t get those file transfers to occur at ‘acceptable speeds’ before

lunch today?

Wireshark

Who smiles and sits around all day long just waiting for the moment you say "I need help"?

Wireshark

That’s right!

So… it’s time to elevate your copy of Wireshark from "network wallflower" to network powerhouse. It’s time to

roll up your sleeves, get rid of the training wheels, put on your helmet and reflective gear, tell everyone to get

the hell out of your way, get on that bike—and ride!

By the way—you have no idea how difficult it was to refrain from adding humor (or at least what I call humor)

to this book. It crept in at various points—some I left in, most I simply moved aside for a later book that might

focus on the humorous side of packet analysis. We will have to wait and see…

Laura Chappell

Founder, Chappell University

Founder, Wireshark University

About This Book

Wireshark Network Analysis: the Official Wireshark Certified Network Analyst™ Study Guide—Second Edition

offers you a solid foundation in the key skills of network analysis, troubleshooting, optimization and security.

By purchasing this book, you have indicated your desire to learn packet-level communications and develop

skills necessary to analyze, troubleshoot and secure networks more efficiently and achieve the Wireshark

Certified Network Analyst certification.

Download the Supplements from

www.wiresharkbook.com

Each chapter concludes with a "Practice What You’ve Learned" section that references traffic files (trace files),

configuration files and other files related to the current chapter. These files are available for download at

www.wiresharkbook.com

. Before delving into this book, it is recommended that you install the latest version of

Wireshark www.wireshark.org

[1] and download the trace files from www.wiresharkbook.com. Create a \traces

directory on your local system and copy these trace files into that directory.

Who is This Book For?

This book offers an ideal reference for information technologists responsible for key network tasks including:

identify poor network performance due to high path latency

locate internetwork devices that drop packets

validate optimal configuration of network hosts

analyze application functionality and dependencies

optimize application behavior for best performance

learn how TCP/IP networks function

analyze network capacity before application launch

verify application security during launch, log in and data transfer

identify unusual network traffic indicating potentially compromised hosts

studying for the Wireshark Certified Network Analyst Exam

How is This Book Organized?

Chapter 1: The World of Network Analysis

explains the key uses of network analysis and provides lists of tasks

used for troubleshooting, securing and optimizing network traffic. This chapter also provides insight into the

"needle in the haystack issue" that overwhelms many new network analysts.

Chapter 2: Introduction to Wireshark

details Wireshark internals, the elements of the Wireshark graphical

interface and functions of the Main Menu, Main Toolbar, Filter Toolbar, Wireless Toolbar, and Status Bar. In

addition, this chapter offers a list of resources recommended for network analysts.

The next eleven chapters (Chapter 3 through Chapter 13) focus on Wireshark functionality with numerous

examples of use and references to trace files available at

www.wiresharkbook.com

. If you are new to

Wireshark, focus on these sections to obtain foundational skills used in later chapters.

Chapter 14 through Chapter 25 concentrate on the key protocols and applications of the TCP/IP suite including

ARP, DNS, IPv4/IPv6, TCP, UDP, and ICMPv4/ICMPv6. Identifying or absolving TCP/IP as part of the

troubleshooting process helps isolate the cause of performance issues and locate security holes. In addition,

these are the chapters you should focus on if you are troubleshooting DHCP-based configurations or

HTTP/HTTPS sessions.

Chapter 26: Introduction to 802.11 (WLAN) Analysis

explains how to capture wireless traffic, identify basic

WLAN problems caused by RF (radio frequency) interference, WLAN retries and access point availability. This

剩余460页未读，继续阅读

ralphsage

粉丝: 27
资源: 96

Wireshark网络分析：官方认证网络分析师学习指南

wireshark-network-analysis第二版

Wireshark 101 Essential Skills for Network Analysis(2nd) 无水印pdf

Network Analysis Using Wireshark Cookbook 无水印pdf

Wireshark Network Analysis Second Edition

Wireshark Network Analysis(2nd) 无水印pdf

Wireshark Network Analysis (Second Edition)

wireshark network analysis

Introduction to Wireshark Network Analysis_wiresharkebook_

Wireshark 101: Essential Skills for Network Analysis 2nd

Wireshark_Network_Analysis(2nd).pdf

最新资源