您的位置:首页 > 其它

Ethereal简介

2006-09-29 20:42 302 查看
ethereal 可以用来从网络上抓包,并能对包进行分析。下面介绍windows 下面ethereal 的使用方法
安装

1)安装winpcap,下载地址http://netgroup-serv.polito.it/winpcap/install/Default.htm 2)安装ethereal ,下载地址http://www.ethereal.com/
使用

windows 程序,使用很简单。
启动ethereal 以后,选择菜单Capature->Start ,就OK 了。当你不想抓的时候,按一下stop, 抓的包就会显示在面板中,并且已经分析好了。
下面是一个截图:





ethereal使用-capture选项



  nterface: 指定在哪个接口(网卡)上抓包。一般情况下都是单网卡,所以使用缺省的就可以了Limit each packet: 限制每个包的大小,缺省情况不限制
  Capture packets in promiscuous mode: 是否打开混杂模式。如果打开,抓取所有的数据包。一般情况下只需要监听本机收到或者发出的包,因此应该关闭这个选项。Filter:过滤器。只抓取满足过滤规则的包(可暂时略过) File:如果需要将抓到的包写到文件中,在这里输入文件名称。use ring buffer: 是否使用循环缓冲。缺省情况下不使用,即一直抓包。注意,循环缓冲只有在写文件的时候才有效。如果使用了循环缓冲,还需要设置文件的数目,文件多大时回卷
  其他的项选择缺省的就可以了
ethereal的抓包过滤器
  抓包过滤器用来抓取感兴趣的包,用在抓包过程中。 抓包过滤器使用的是libcap 过滤器语言,在tcpdump 的手册中有详细的解释,基本结构是: [not] primitive [and|or [not] primitive ...]
个人观点,如果你想抓取某些特定的数据包时,可以有以下两种方法,你可以任选一种, 个人比较偏好第二种方式:
  1、在抓包的时候,就先定义好抓包过滤器,这样结果就是只抓到你设定好的那些类型的数 据包;
  2、先不管三七二十一,把本机收到或者发出的包一股脑的抓下来,然后使用下节介绍的显 示过滤器,只让Ethereal 显示那些你想要的那些类型的数据包;
etheral的显示过滤器(重点内容)
  在抓包完成以后,显示过滤器可以用来找到你感兴趣的包,可以根据1)协议2)是否存在某个域3)域值4)域值之间的比较来查找你感兴趣的包。
  举个例子,如果你只想查看使用tcp 协议的包,在ethereal 窗口的左下角的Filter 中输入tcp, 然后回车,ethereal 就会只显示tcp 协议的包。如下图所示:



  值比较表达式可以使用下面的操作符来构造显示过滤器自然语言类c 表示举例eq == ip.addr==10.1.10.20 ne != ip.addr!=10.1.10.20 gt > frame.pkt_len>10 lt < frame.pkt_len<10 ge >= frame.pkt_len>=10 le <= frame.pkt_len<=10
  表达式组合可以使用下面的逻辑操作符将表达式组合起来自然语言类c 表示举例and && 逻辑与,比如ip.addr=10.1.10.20&&tcp.flag.fin or || 逻辑或,比如ip.addr=10.1.10.20||ip.addr=10.1.10.21 xor ^^ 异或,如tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == not ! 逻辑非,如 !llc
例如:
我想抓取IP 地址是192.168.2.10 的主机,它所接收收或发送的所有的HTTP 报文,那么合适的显示Filter (过滤器)就是:



在ethereal 使用协议插件
ethereal 能够支持许多协议,但有些协议需要安装插件以后才能解,比如H.323,以H.323 协议为例,首先下载ethereal 的H.323 插件,下载地址http://www.voice2sniff.org/ 下载完了以后将文件(h323.dll) 解压到ethereal 安装目录的plugin/0.9.x 目录下面,比如我的是0.9.11 ,然后,需要进行一下设置1)启动ethereal 2)菜单Edit->Preference 3)单击Protocols 前面的"+"号,展开Protocols 4)找到Q931 ,并单击5)确保"Desegment.... TCP segments" 是选中的(即方框被按下去)6)单击TCP 7)确保"Allow....TCP streams" 是选中的8)确保没有选中"Check....TCP checksum" 和"Use....sequence numbers" 9)单击TPKT 10)确保"Desegment....TCP segments" 是选中的11)点击Save,然后点击Apply ,然后点击OK 你也完全可以不断地重新安装新版本winpcap 和ethreal, 这样就可以不需在旧的ethreal 的版本中安装新的插件来支持新的协议插件。

转自



支持的协议分析

759 protocols can currently be dissected:
3COMXNS, 3GPP2 A11, 802.11 MGT, 802.11 Radiotap, 802.3 Slow protocols, 9P, AAL1, AAL3/4, AARP, ACAP, ACN, ACP133, ACSE, ACtrace, ADP, AFP, AFS (RX), AH, AIM, AIM Administration, AIM Advertisements, AIM BOS, AIM Buddylist, AIM Chat, AIM ChatNav, AIM Directory, AIM Email, AIM Generic, AIM ICQ, AIM Invitation, AIM Location, AIM Messaging, AIM OFT, AIM Popup, AIM SSI, AIM SST, AIM Signon, AIM Stats, AIM Translate, AIM User Lookup, AJP13, ALC, ALCAP, AMR, ANS, ANSI BSMAP, ANSI DTAP, ANSI IS-637-A Teleservice, ANSI IS-637-A Transport, ANSI IS-683-A (OTA (Mobile)), ANSI IS-801 (Location Services (PLD)), ANSI MAP, AODV, AOE, ARCNET, ARP/RARP, ARTNET, ASAP, ASF, ASN1, ASP, ATM, ATM LANE, ATP, ATSVC, ***S WLANCAP, AX4000, AgentX, Armagetronad, Auto-RP, BACapp, BACnet, BEEP, BER, BFD Control, BGP, BICC, BOFL, BOOTP/DHCP, BOOTPARAMS, BOSSVR, BROWSER, BSSAP, BSSGP, BUDB, BUTC, BVLC, Basic Format XID, BitTorrent, Boardwalk, CAMEL, CAST, CBAPDev, CCSDS, CCSRL, CDP, CDS_CLERK, CDT, CFLOW, CGMP, CHDLC, CIGI, CIMD, CIP, CISCOWL-L2, CLDAP, CLEARCASE, CLNP, CLTP, CMIP, CMP, CMS, CONV, COPS, COSEVENTCOMM, COSNAMING, COTP, CPFI, CPHA, CRMF, CSM_ENCAPS, CUPS, CoSine, DAAP, DAP, DCCP, DCERPC, DCE_DFS, DCOM, DCP, DDP, DDTP, DEC_DNA, DEC_STP, DFS, DHCPFO, DHCPv6, DIAMETER, DIS, DISP, DISTCC, DLSw, DLT User A, DLT User B, DLT User C, DLT User D, DNP 3.0, DNS, DNSSERVER, DOCSIS, DOCSIS BPKM-ATTR, DOCSIS BPKM-REQ, DOCSIS BPKM-RSP, DOCSIS DCC-ACK, DOCSIS DCC-REQ, DOCSIS DCC-RSP, DOCSIS DCD, DOCSIS DSA-ACK, DOCSIS DSA-REQ, DOCSIS DSA-RSP, DOCSIS DSC-ACK, DOCSIS DSC-REQ, DOCSIS DSC-RSP, DOCSIS DSD-REQ, DOCSIS DSD-RSP, DOCSIS INT-RNG-REQ, DOCSIS MAC MGMT, DOCSIS MAP, DOCSIS REG-ACK, DOCSIS REG-REQ, DOCSIS REG-RSP, DOCSIS RNG-REQ, DOCSIS RNG-RSP, DOCSIS TLVs, DOCSIS UCC-REQ, DOCSIS UCC-RSP, DOCSIS UCD, DOCSIS VSIF, DOCSIS type29ucd, DOP, DRSUAPI, DSI, DSP, DSSETUP, DTP, DTSPROVIDER, DTSSTIME_REQ, DUA, DVMRP, Data, E.164, E.212, EAP, EAPOL, ECHO, EDONKEY, EDP, EFS, EIGRP, ENC, ENIP, ENRP, ENTTEC, EPM, EPMv4, ESIS, ESP, ESS, ETHERIC, ETHERIP, EVENTLOG, Ethernet, FC, FC ELS, FC FZS, FC-FCS, FC-SB3, FC-SP, FC-SWILS, FC-dNS, FCIP, FCP, FC_CT, FDDI, FIX, FLDB, FR, FRSAPI, FRSRPC, FTAM, FTBP, FTP, FTP-DATA, FTSERVER, FW-1, Frame, G.723, GIF image, GIOP, GMRP, GNM, GNUTELLA, GPRS NS, GPRS-LLC, GRE, GSM BSSMAP, GSM DTAP, GSM RP, GSM SMS, GSM SMS UD, GSM_MAP, GSM_SS, GSS-API, GTP, GVRP, Gryphon, H.223, H.225.0, H.235, H.245, H.261, H.263, H.263 data, H1, H248, HCLNFSD, HPEXT, HPSW, HSRP, HTTP, HyperSCSI, IAP, IAPP, IAX2, IB, ICAP, ICBAAccoCB, ICBAAccoCB2, ICBAAccoMgt, ICBAAccoMgt2, ICBAAccoServ, ICBAAccoServ2, ICBAAccoServSRT, ICBAAccoSync, ICBABrowse, ICBABrowse2, ICBAGErr, ICBAGErrEvent, ICBALDev, ICBALDev2, ICBAPDev, ICBAPDev2, ICBAPDevPC, ICBAPDevPCEvent, ICBAPersist, ICBAPersist2, ICBARTAuto, ICBARTAuto2, ICBAState, ICBAStateEvent, ICBASysProp, ICBATime, ICEP, ICL_RPC, ICMP, ICMPv6, ICP, ICQ, IDP, IDispatch, IEEE 802.11, IEEE802a, IGAP, IGMP, IGRP, ILMI, IMAP, INAP, INITSHUTDOWN, IOXIDResolver, IP, IP/IEEE1394, IPComp, IPDC, IPFC, IPMI, IPP, IPVS, IPX, IPX MSG, IPX RIP, IPX SAP, IPX WAN, IPv6, IRC, IRemUnknown, IRemUnknown2, ISAKMP, ISDN, ISIS, ISL, ISMP, ISUP, ISystemActivator, IUA, IrCOMM, IrLAP, IrLMP, IuUP, JFIF (JPEG) image, JXTA, JXTA Message, Jabber, Juniper, K12xx, KADM5, KINK, KLM, KRB4, KRB5, KRB5RPC, Kpasswd, L2TP, LANMAN, LAPB, LAPBETHER, LAPD, LDAP, LDP, LGE_Monitor, LLAP, LLC, LLDP, LMI, LMP, LOOP, LPD, LSA, LWAPP, LWAPP-CNTL, LWAPP-L3, LWRES, Laplink, Line-based text data, Log, LogotypeCertExtn, Lucent/Ascend, M2PA, M2TP, M2UA, M3UA, MACC, MAPI, MAP_DialoguePDU, MATE, MDS Header, MEGACO, MGCP, MGMT, MIME multipart, MIPv6, MMS, MMSE, MOUNT, MPEG1, MPLS, MPLS Echo, MQ, MQ PCF, MRDISC, MS NLB, MS Proxy, MSDP, MSMMS, MSNIP, MSNMS, MSRP, MTP2, MTP3, MTP3MG, Manolito, Media, Messenger, Mobile IP, Modbus/TCP, MySQL, NBAP, NBDS, NBIPX, NBNS, NBP, NBSS, NCP, NCS, NDMP, NDPS, NFS, NFSACL, NFSAUTH, NHRP, NIS+, NIS+ CB, NJACK, NLM, NLSP, NMAS, NMPI, NNTP, NORM, NSIP, NSPI, NS_CERT_EXTS, NTLMSSP, NTP, NW_SERIAL, NetBIOS, Netsync, Null, OAM AAL, OCSP, OICQ, OLSR, OPSI, OSPF, PACKETCABLE, PAGP, PAP, PARLAY, PCLI, PCNFSD, PER, PFLOG, PFLOG-OLD, PGM, PGSQL, PIM, PKCS-1, PKIX Certificate, PKIX1EXPLICIT, PKIX1IMPLICIT, PKIXPROXY, PKIXQUALIFIED, PKIXTSP, PKInit, PKT CCC, PKTC, PN-DCP, PN-RT, PNIO, PNP, POP, PPP, PPP BACP, PPP BAP, PPP BCP, PPP CBCP, PPP CCP, PPP CDPCP, PPP CHAP, PPP Comp, PPP IPCP, PPP IPV6CP, PPP LCP, PPP MP, PPP MPLSCP, PPP OSICP, PPP PAP, PPP PPPMux, PPP PPPMuxCP, PPP VJ, PPP-HDLC, PPPoED, PPPoES, PPTP, PRES, PTP, PVFS, P_MUL, Portmap, Prism, Q.2931, Q.931, Q.933, QLLC, QUAKE, QUAKE2, QUAKE3, QUAKEWORLD, R-STP, RADIUS, RANAP, RDM, RDT, REMACT, REP_PROC, RIP, RIPng, RLM, RMCP, RMI, RMP, RNSAP, ROS, RPC, RPC_BROWSER, RPC_NETLOGON, RPL, RQUOTA, RRAS, RSH, RSTAT, RSVP, RSYNC, RS_ACCT, RS_ATTR, RS_BIND, RS_PGO, RS_PLCY, RS_REPADM, RS_REPLIST, RS_UNIX, RTCP, RTMP, RTP, RTP Event, RTPS, RTSE, RTSP, RTcfg, RTmac, RUDP, RWALL, RX, Raw, Raw_SIP, Raw_SigComp, Redback, Rlogin, SADMIND, SAMR, SAP, SCCP, SCCPMG, SCSI, SCTP, SDLC, SDP, SEBEK, SECIDMAP, SES, SGI MOUNT, SIGCOMP, SIP, SIPFRAG, SIR, SKINNY, SLARP, SLL, SM, SMB, SMB Mailslot, SMB Pipe, SMB2, SMB_NETLOGON, SMPP, SMRSE, SMTP, SMUX, SNA, SNA XID, SNAETH, SNDCP, SNMP, SONMP, SPNEGO, SPNEGO-KRB5, SPOOLSS, SPP, SPRAY, SPX, SRP, SRVLOC, SRVSVC, SSCF-NNI, SSCOP, SSH, SSL, SSS, STANAG 4406, STANAG 5066, STAT, STAT-CB, STP, STUN, SUA, SVCCTL, Serialization, SliMP3, Socks, SoulSeek, Symantec, Synergy, Syslog, T.30, T.38, TACACS, TACACS+, TALI, TANGO, TAPI, TCAP, TCP, TDMA, TDS, TEI_MANAGEMENT, TELNET, TFTP, TIME, TIPC, TKN4Int, TNS, TPCP, TPKT, TR MAC, TRKSVR, TSP, TTP, TUXEDO, TZSP, Teredo, Token-Ring, UBIKDISK, UBIKVOTE, UCP, UDP, UDPENCAP, UDPlite, UMA, V.120, V5UA, VLAN, VNC, VRRP, VTP, Vines ARP, Vines Echo, Vines FRP, Vines ICP, Vines IP, Vines IPC, Vines LLC, Vines RTP, Vines SPP, WAP SIR, WBXML, WCCP, WCP, WHDLC, WHO, WINREG, WINS-Replication, WKSSVC, WLANCERTEXTN, WSP, WTLS, WTP, X.25, X.29, X11, X411, X420, X509AF, X509CE, X509IF, X509SAT, XDMCP, XML, XOT, XYPLEX, YHOO, YMSG, YPBIND, YPPASSWD, YPSERV, YPXFR, ZEBRA, ZIP, cds_solicit, cprpc_server, dc, dce_update, dicom, giFT, h221nonstd, h450, iFCP, iSCSI, iSNS, isup_thin, itunes, llb, message/http, nettl, rdaclif, roverride, rpriv, rs_attr_schema, rs_misc, rs_prop_acct, rs_prop_acl, rs_prop_attr, rs_prop_pgo, rs_prop_plcy, rs_pwd_mgmt, rs_repmgr, rsec_login, rss, sFlow, smil,





其他文章:

.NET 与安全性—— 数据加密算法

修改权限防止病毒或木马等破坏您的系统

linux下获得硬盘序列号的c源代码

分享骇客技术的七大秘籍

巧用win2000/xp管理工具优化操作系统

使破解你程序的人感到头疼

一个崭新的数据加密算法

在VC中使用 Flash 美化你的程序

google_ad_client = "pub-2416224910262877";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_channel = "";
google_color_border = "E1771E";
google_color_bg = "FFFFFF";
google_color_link = "0000FF";
google_color_text = "000000";
google_color_url = "008000";
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息
标签: