Yadda Ake Amfani da Wireshark akan Windows: Cikakken Jagora, Mai Aiki, da Jagoran Kwanan Wata

Shin kun taɓa yin mamaki Menene ainihin ke faruwa akan hanyar sadarwar ku lokacin da kuke nema, kunna kan layi, ko sarrafa na'urori masu alaƙa? Idan kawai kuna sha'awar abubuwan sirrin da ke yawo akan WiFi ɗin ku, ko kuma idan kuna buƙatar ƙwararrun kayan aiki kawai Yi nazarin zirga-zirgar hanyar sadarwa kuma gano matsaloli tare da haɗin haɗin ku, tabbas sunan Wireshark ya riga ya dauki hankalin ku.

To, a cikin wannan labarin za ku gano ba tare da karkata ba duk cikakkun bayanai game da Wireshark: Mene ne, abin da ake amfani dashi a cikin Windows, yadda ake shigar da shi, da kuma mafi kyawun shawarwari kafin ka fara ɗaukar bayanai. Mu isa gare shi.

Menene Wireshark? Rushe titan na bincike na cibiyar sadarwa

Wireshark shine mafi shahara kuma sanannen mai nazarin ka'idojin cibiyar sadarwa a duk duniya.. Wannan kyauta, buɗaɗɗen tushe da kayan aiki mai ƙarfi yana ba ku damar kama da bincika duk zirga-zirgar hanyar sadarwa wanda ke wucewa ta cikin kwamfutarka, ko na'ura ce ta Windows, Linux, macOS, ko ma tsarin kamar FreeBSD da Solaris. Tare da Wireshark, za ku iya gani, a cikin ainihin lokaci ko bayan yin rikodin, ainihin fakitin da ke shiga da barin kwamfutarka, tushen su, wurinsu, ka'idoji, har ma da karya su don samun cikakkun bayanai na kowane Layer bisa ga tsarin OSI.

Ba kamar yawancin masu nazari ba, Wireshark ya yi fice don keɓancewar ƙirar ƙirar sa, amma kuma yana ba da sigar wasan bidiyo mai ƙarfi da ake kira TShark ga waɗanda suka fi son layin umarni ko buƙatar yin ayyuka na atomatik. Sassaucin Wireshark Irin wannan yana ba ku damar bincika haɗin gwiwa yayin bincike, don yin bincike na tsaro na ƙwararru, warware matsalolin hanyar sadarwa, ko koya daga karce game da yadda ka'idodin Intanet ke aiki, duk daga PC ɗin ku!

Zazzagewa kuma shigar da Wireshark akan Windows

Shigar da Wireshark akan Windows tsari ne mai sauƙi., amma yana da kyau a yi shi mataki-mataki don kada a bar kowane sako mara kyau, musamman game da izini da ƙarin direbobi don kamawa.

• Zazzagewar hukuma: Samun damar zuwa gidan yanar gizon Wireshark na hukuma kuma zaɓi nau'in Windows (32 ko 64 ragowa dangane da tsarin ku).
• Run mai sakawa: Danna fayil ɗin da aka sauke sau biyu kuma bi mayen. Karɓi tsoffin zaɓuɓɓuka idan kuna da wasu tambayoyi.
• Direbobi masu mahimmanci: Yayin shigarwa, mai sakawa zai tambaye ku shigar Npcap. Wannan bangaren yana da mahimmanci, saboda yana ba da damar katin sadarwar ku don ɗaukar fakiti a cikin yanayin "fasikanci". Yarda da shigarwa.
• Kashe kuma sake farawa: Da zarar aikin ya cika, sake kunna kwamfutarka don tabbatar da an shirya duk abubuwan da aka gyara.

Shirya! Yanzu zaku iya fara amfani da Wireshark daga menu na Fara Windows. Lura cewa ana sabunta wannan shirin akai-akai, don haka yana da kyau a bincika sabbin nau'ikan lokaci zuwa lokaci.

Yadda Wireshark ke Aiki: Ɗaukar Fakiti da Nuni

Lokacin da ka bude Wireshark, Abu na farko da za ku gani shine jerin duk hanyoyin sadarwa na cibiyar sadarwa da ke cikin tsarin ku.: Katin sadarwar waya, WiFi, har ma da adaftar kama-da-wane idan kuna amfani da injunan kama-da-wane kamar VMware ko VirtualBox. Kowane ɗayan waɗannan musaya yana wakiltar wurin shiga ko fita don bayanan dijital.

Don fara ɗaukar bayanai, Dole ne ku danna sau biyu akan abin da ake so. Tun daga nan, Wireshark zai nuna a ainihin lokacin duk fakitin da ke yawo ta wannan kati, rarraba su ta ginshiƙai kamar lambar fakiti, lokacin kamawa, tushe, makoma, yarjejeniya, girman, da ƙarin cikakkun bayanai.

Lokacin da kake son dakatar da ɗauka, danna maɓallin maballin Tsaida ja. Kuna iya adana abubuwan da kuka ɗauka a tsarin .pcap don bincike na gaba, rabawa, ko ma fitar da su ta nau'i daban-daban (CSV, rubutu, matsawa, da sauransu). Wannan sassauci shine abin da ke sa Wireshark kayan aiki ne da ba makawa don duka binciken tabo da cikakken bincike..

Farawa: Nasihu Kafin Ɗaukar Hoton hoto a Windows

Don tabbatar da cewa kamawar Wireshark na farko na da amfani kuma kar a cika su da hayaniya ko ruɗani, akwai wasu mahimman shawarwarin da za a bi:

• Rufe shirye-shiryen da ba dole ba: Kafin fara kamawa, fita aikace-aikacen da ke haifar da zirga-zirgar bayanan baya (sabuntawa, taɗi, abokan cinikin imel, wasanni, da sauransu). Ta wannan hanyar za ku guje wa haɗa zirga-zirgar da ba ta dace ba.
• Sarrafa Tacewar zaɓi: Firewalls na iya toshe ko canza zirga-zirga. Yi la'akari da kashe shi na ɗan lokaci idan kuna neman cikakken kamawa.
• Ɗauki abin da ya dace kawaiIdan kuna son bincika takamaiman ƙa'idar, jira daƙiƙa ɗaya ko biyu bayan fara kamawa don ƙaddamar da app ɗin, kuma kuyi haka lokacin rufewa kafin dakatar da rikodin.
• Sanin aikin dubawar ku: Tabbatar cewa kun zaɓi katin cibiyar sadarwa daidai, musamman idan kuna da adaftar da yawa ko kuna kan hanyar sadarwa ta kama-da-wane.

Ta bin waɗannan jagororin, hotunan kariyar ka za su kasance mafi tsabta da amfani ga kowane ƙarin bincike..

Tace a cikin Wireshark: Yadda ake Mayar da hankali kan Abin da Yake Mahimmanci

Daya daga cikin mafi iko fasali na Wireshark ne tacewa. Akwai nau'ikan asali guda biyu:

• Ɗauki tacewa: Ana amfani da su kafin fara kamawa, yana ba ku damar tattara zirga-zirgar da ke sha'awar ku daga farko.
• Nuna masu tacewa: Waɗannan sun shafi jerin fakitin da aka riga aka kama, suna ba ku damar nunawa kawai waɗanda suka cika sharuddan ku.

Daga cikin mafi yawan abubuwan tacewa sune:

• Ta hanyar yarjejeniya: Tace fakitin HTTP, TCP, DNS, da sauransu kawai.
• Ta hanyar adireshin IP: Misali, nuni kawai fakiti daga ko zuwa takamaiman IP ta amfani da ip.src == 192.168.1.1 o ip.dst == 8.8.8.8.
• Ta tashar jiragen ruwa: Yana iyakance sakamako zuwa takamaiman tashar jiragen ruwa (tcp.port == 80).
• Ta hanyar zaren rubutu: Gano fakitin da ke ƙunshe da kalma a cikin abun ciki.
• Ta adireshin MAC, tsawon fakiti ko kewayon IP.

Bugu da ƙari, ana iya haɗa masu tacewa tare da masu aiki masu ma'ana (da kuma, or, ba) don ingantattun bincike, kamar tcp.port == 80 da ip.src == 192.168.1.1.

Me zaku iya kamawa da bincika tare da Wireshark akan Windows?

Wireshark da iya fassara fiye da 480 daban-daban ladabi, daga asali kamar TCP, UDP, IP, zuwa ƙayyadaddun ƙa'idodin aikace-aikacen, IoT, VoIP, da sauran su. Wannan yana nufin zaku iya bincika kowane nau'in zirga-zirgar hanyar sadarwa, daga sauƙaƙe tambayoyin DNS zuwa rufaffen zaman SSH, haɗin HTTPS, Canja wurin FTP, ko zirga-zirgar SIP daga wayar Intanet.

Har ila yau, Wireshark yana goyan bayan daidaitattun tsarin kama kamar tcpdump (libpcap), pcapng da sauransu, kuma yana ba ku damar damfara da damfara hotunan hotunan akan tashi ta amfani da GZIP don adana sarari. Don rufaffen zirga-zirga (TLS/SSL, IPsec, WPA2, da sauransu), idan kuna da maɓallan da suka dace, zaku iya lalata bayanan kuma duba ainihin abun ciki.

Cikakken kama zirga-zirga: ƙarin shawarwari

Kafin fara kowane muhimmin kama, bi wannan ka'idar don haɓaka amfanin bayanan da aka tattara.:

• Zaɓi madaidaicin dubawa: Yawanci adaftar ku mai aiki ita ce hanyar haɗin da kuke amfani da ita. Idan kuna da shakku, bincika wanda aka haɗa daga saitunan cibiyar sadarwar Windows.
• Saita wurin: Bude kawai shirye-shirye ko apps waɗanda zasu haifar da zirga-zirgar da kuke son tantancewa.
• Ware al'amarinIdan kana neman bincikar zirga-zirgar app, bi wannan jerin: ƙaddamar da ƙa'idar bayan fara kamawa, aiwatar da aikin da kuke son tantancewa, sannan rufe app ɗin kafin dakatar da rikodin.
• Ajiye hoton hoton: Dakatar da rikodi, je zuwa Fayil> Ajiye kuma zaɓi .pcap ko tsarin da kuka fi so.

Wannan shine yadda zaku samu mai tsabta da sauƙi don nazarin fayiloli, ba tare da an gauraya tagulla ba.

Misalai masu ma'ana: nazarin zirga-zirga tare da Wireshark

A ce kana da kwamfutoci guda biyu a cibiyar sadarwar ku kuma ɗaya daga cikinsu ta daina shiga Intanet. Kuna iya amfani da Wireshark don kama zirga-zirga daga wannan injin. kuma duba idan akwai kurakurai da ke warware adiresoshin DNS, idan fakiti ba sa isa ga na'ura mai ba da hanya tsakanin hanyoyin sadarwa, ko kuma idan Tacewar zaɓi yana toshe hanyoyin sadarwa.

Wani lamari na al'ada: gano idan gidan yanar gizon bai ɓoye sirrin shigar ku da kyau ba. Idan ka shiga gidan yanar gizo ba tare da HTTPS ba kuma ka yi amfani da tace HTTP hade da sunan mai amfani, za ka iya ma ganin kalmar sirrinka tana tafiya a sarari akan hanyar sadarwa, nunin rayuwa na haƙiƙanin haɗarin gidajen yanar gizo marasa tsaro.

Wireshark da Tsaro: Hatsari, Hare-hare, da Matakan Kariya

Ikon Wireshark kuma shine babban haɗarinsa: A cikin hannaye mara kyau, yana iya sauƙaƙe kamawa, leƙen asiri, ko bayyana mahimman bayanai.. Ga wasu barazana da shawarwari:

• Shaye-shaye (hare-haren da za a iya tabbatar da gaskiya): Idan ka kama SSH, Telnet, ko wasu zirga-zirgar sabis, za ka iya lura da ƙoƙarin shiga ta atomatik. Kula da mafi tsayin zama (yawanci suna cin nasara), girman fakiti, da adadin yunƙurin gano alamu masu tuhuma.
• Hadarin zirga-zirga na waje: Tace duk zirga-zirgar SSH wanda baya zuwa daga hanyar sadarwar ku ta ciki: idan kun ga haɗin gwiwa daga waje, ku kasance faɗakarwa!
• Kalmomin sirrin rubutu: Idan gidan yanar gizon yana aika sunayen masu amfani da kalmomin shiga da ba a ɓoye ba, za ku gan shi a cikin hoton. Kar a taɓa amfani da Wireshark don samun wannan bayanan akan cibiyoyin sadarwar waje. Ka tuna cewa yin hakan ba tare da izini ba haramun ne.
• Yarda da doka: Yana nazarin zirga-zirga daga cibiyoyin sadarwar kansa kawai ko tare da bayyanannen izini. Dokar ta fito fili a kan wannan batu, kuma yin amfani da shi ba zai iya haifar da mummunan sakamako ba.
• Gaskiya da xa'a: Idan kuna aiki a cikin yanayin kamfani, sanar da masu amfani game da bincike da manufarsa. Girmama sirri yana da mahimmanci kamar tsaro na fasaha.

Madadin Wireshark: Wasu Zaɓuɓɓuka don Nazarin hanyar sadarwa

Wireshark shine bayanin da ba a jayayya ba, amma akwai wasu kayan aikin da zasu iya dacewa ko, a cikin takamaiman yanayi, maye gurbin amfani da shi:

• tcpdump: Mafi kyau ga mahallin Unix/Linux, yana aiki akan layin umarni. Yana da nauyi, sauri da sassauƙa don ɗaukar sauri ko ayyuka na atomatik.
• Cloudshark: Dandalin yanar gizo don lodawa, nazari, da kuma raba fakitin da aka kama daga mai lilo. Da amfani sosai ga mahallin haɗin gwiwa.
• SmartSniff: An mai da hankali kan Windows, mai sauƙin amfani don ɗaukar tabo da kallon tattaunawa tsakanin abokan ciniki da sabar.
• ColaSoft Capsa: Mai duba hanyar sadarwa mai hoto wanda ya fito don sauƙaƙan mu'amalarsa da takamaiman zaɓuɓɓuka don duba tashar jiragen ruwa, fitarwa, da ƙaramin gani.

Zaɓin mafi kyawun madadin ya dogara da takamaiman bukatunku.: saurin, dubawar hoto, haɗin gwiwar kan layi, ko dacewa tare da takamaiman kayan aiki.

Babban Saituna: Yanayin lalata, Kulawa, da Ƙimar Suna

Yanayin lalata yana ba da damar katin sadarwar don ɗaukar hoto ba kawai kayan da aka nufa mata ba, amma duk zirga-zirgar da ke yawo ta hanyar sadarwar da aka haɗa ta. Yana da mahimmanci don nazarin hanyoyin sadarwa na kamfanoni, wuraren da aka raba, ko al'amuran da suka faru.

A kan Windows, je zuwa Ɗauka > Zabuka, zaɓi wurin dubawa kuma duba akwatin yanayin lalata. Ka tuna cewa akan hanyoyin sadarwar Wi-Fi, ban da takamaiman kayan aiki, kawai za ku ga zirga-zirga daga na'urar ku.

A gefe guda, Ƙaddamar suna yana canza adiresoshin IP zuwa sunayen yanki da mutum zai iya karantawa (misali, 8.8.8.8 a cikin google-public-dns-a.google.com). Kuna iya kunna ko kashe wannan zaɓi daga Shirya> Zaɓuɓɓuka> Ƙimar Suna. Yana taimakawa da yawa don gano na'urori yayin dubawa, kodayake yana iya ragewa tsarin idan akwai adiresoshin da yawa da ake warwarewa.