Yuav Siv Wireshark li cas rau ntawm Windows: Daim Ntawv Qhia Ua tiav, Ua Tau Zoo, thiab Tshaj Tawm

Koj puas tau xav Dab tsi tshwm sim tiag tiag ntawm koj lub network thaum koj xauj, ua si hauv online, lossis tswj cov khoom siv sib txuas? Yog tias koj tsuas yog xav paub txog qhov tsis meej uas tshwm sim ntawm koj lub WiFi, lossis yog tias koj tsuas xav tau cov cuab yeej tshaj lij rau Tshawb xyuas cov tsheb khiav hauv lub network thiab tshawb xyuas cov teeb meem nrog koj qhov kev sib txuas, muaj tseeb lub npe Wireshark twb ntes tau koj mloog.

Zoo, hauv kab lus no koj yuav pom yam tsis muaj kev taug kev tag nrho cov ntsiab lus hais txog Wireshark: Nws yog dab tsi, nws tau siv rau hauv Windows, yuav ua li cas rau nruab, thiab cov lus qhia zoo tshaj plaws ua ntej koj pib ntes cov ntaub ntawv. Wb mus txog nws.

Wireshark yog dab tsi? rhuav tshem lub titan ntawm kev tsom xam network

Wireshark yog qhov nrov tshaj plaws thiab lees paub lub network raws tu qauv ntsuas ntsuas thoob ntiaj teb.. Qhov no pub dawb, qhib qhov chaw thiab cov cuab yeej muaj zog tso cai rau koj ntes thiab tshuaj xyuas tag nrho cov tsheb khiav hauv lub network uas dhau los ntawm koj lub computer, txawm tias nws yog Windows, Linux, macOS tshuab, lossis txawm tias cov tshuab xws li FreeBSD thiab Solaris. Nrog Wireshark, koj tuaj yeem pom, hauv lub sijhawm tiag tiag lossis tom qab kaw, raws nraim cov pob ntawv nkag mus thiab tawm hauv koj lub computer, lawv qhov chaw, qhov chaw, cov txheej txheem, thiab txawm tias lawv tawg kom tau txais cov ntsiab lus ntawm txhua txheej raws li OSI qauv.

Tsis zoo li ntau tus kws tshuaj ntsuam xyuas, Wireshark sawv tawm rau nws qhov kev nkag siab graphical interface, tab sis kuj muaj lub zog console version hu ua TShark rau cov neeg uas nyiam cov kab hais kom ua lossis xav tau ua cov haujlwm automated. Kev hloov pauv ntawm Wireshark Nws yog qhov uas nws tso cai rau koj los txheeb xyuas qhov kev sib txuas thaum koj xauj, ua cov kev soj ntsuam kev ruaj ntseg, daws cov teeb meem hauv lub network, lossis kawm los ntawm kos txog seb Internet raws tu qauv ua haujlwm li cas, tag nrho los ntawm koj tus kheej lub PC!

Rub tawm thiab nruab Wireshark ntawm Windows

Txhim kho Wireshark ntawm Windows yog txheej txheem yooj yim., tab sis nws raug nquahu kom ua nws ib kauj ruam zuj zus kom tsis txhob tawm ntawm qhov xoob xaus, tshwj xeeb tshaj yog hais txog kev tso cai thiab cov tsav tsheb ntxiv rau kev ntes.

• Official download: Nkag mus rau lub vev xaib official Wireshark thiab xaiv lub Windows version (32 lossis 64 khoom nyob ntawm koj lub cev).
• Khiav lub installer: Ob-nias cov ntaub ntawv downloaded thiab ua raws li tus wizard. Txais cov kev xaiv ua ntej yog tias koj muaj lus nug.
• Cov tsav tsheb tseem ceeb: Thaum lub sij hawm installation, tus installer yuav nug koj install Npcap. Cov khoom no yog qhov tseem ceeb, vim nws tso cai rau koj daim npav network los ntes cov pob ntawv hauv "promiscuous" hom. Txais nws lub installation.
• Terminate thiab restart: Thaum cov txheej txheem tiav lawm, rov pib koj lub computer kom paub meej tias tag nrho cov khoom tau npaj txhij.

Npaj txhij! Tam sim no koj tuaj yeem pib siv Wireshark los ntawm Windows Start menu. Thov nco ntsoov tias qhov kev pab cuam no nquag hloov kho, yog li nws yog ib lub tswv yim zoo los xyuas cov ntawv tshiab ntawm lub sijhawm.

Yuav Ua Li Cas Wireshark Ua Haujlwm: Ntim thiab Zaub

Thaum koj qhib Wireshark, Thawj qhov koj yuav pom yog cov npe ntawm tag nrho cov network interfaces muaj nyob hauv koj lub cev.: Wired network cards, WiFi, thiab txawm tias virtual adapters yog tias koj siv cov tshuab virtual xws li VMware lossis VirtualBox. Txhua qhov ntawm cov interfaces no sawv cev rau qhov nkag lossis tawm rau cov ntaub ntawv digital.

Yuav pib ntes cov ntaub ntawv, Koj tsuas yog yuav tsum tau ob-nias ntawm qhov xav tau interface. Txij thaum ntawd los, Wireshark yuav tso tawm nyob rau lub sijhawm tiag tiag txhua pob ntawv uas ncig los ntawm daim npav ntawd, txheeb lawv los ntawm kab xws li pob ntawv naj npawb, ntes lub sijhawm, qhov chaw, qhov chaw, qhov chaw, raws tu qauv, qhov loj me, thiab cov ntsiab lus ntxiv.

Thaum koj xav kom tsis txhob ntes, nias lub liab Stop khawm. Koj tuaj yeem txuag koj cov kev ntes hauv .pcap hom ntawv rau kev txheeb xyuas tom qab, sib koom, lossis txawm tias xa tawm ntau hom ntawv (CSV, ntawv nyeem, compressed, thiab lwm yam). Qhov kev hloov pauv no yog qhov ua tau Wireshark yog ib qho cuab yeej tseem ceeb rau ob qho tib si tsom xam thiab kev tshawb xyuas tag nrho..

Pib Pib: Cov Lus Qhia Ua Ntej Yuav Siv Daim Duab Duab Hauv Windows

Txhawm rau kom ntseeg tau tias koj thawj Wireshark captures muaj txiaj ntsig thiab tsis tas yuav muaj lub suab nrov lossis cov ntaub ntawv tsis meej pem, muaj ntau cov lus pom zoo kom ua raws li:

• Kaw cov kev pab cuam uas tsis tsim nyog: Ua ntej pib qhov kev ntes, tawm cov ntawv thov uas tsim cov tsheb khiav tom qab (hloov tshiab, sib tham, email neeg siv, games, thiab lwm yam). Txoj kev no koj yuav zam kev sib xyaw cov tsheb tsis sib xws.
• Tswj lub firewall: Firewalls tuaj yeem thaiv lossis hloov tsheb. Xav txog kev kaw nws ib ntus yog tias koj tab tom nrhiav kev ntes tag nrho.
• Khaws tsuas yog qhov tseem ceebYog tias koj xav txheeb xyuas ib qho app tshwj xeeb, tos ib pliag lossis ob zaug tom qab pib qhov kev ntes kom tso lub app, thiab ua tib yam thaum kaw nws ua ntej nres qhov kaw.
• Paub koj lub active interface: Nco ntsoov tias koj xaiv daim npav network kom raug, tshwj xeeb tshaj yog tias koj muaj ntau lub adapters lossis nyob rau hauv lub network virtual.

Los ntawm kev ua raws li cov lus qhia no, koj cov screenshots yuav huv dua thiab muaj txiaj ntsig zoo rau kev tshuaj xyuas ntxiv..

Lim hauv Wireshark: Yuav Ua Li Cas Tsom Rau Qhov Tseem Ceeb

Ib qho tseem ceeb tshaj plaws ntawm Wireshark yog cov ntxaij lim dej. Muaj ob hom kev yooj yim:

• Nthuav cov ntxaij lim dej: Lawv tau thov ua ntej pib ntes, tso cai rau koj los sau cov tsheb uas koj nyiam thaum pib.
• Tso cov ntxaij lim dej: Cov no siv rau cov npe ntawm cov pob ntawv uas twb tau ntes lawm, tso cai rau koj los tso saib tsuas yog cov uas ua tau raws li koj cov txheej txheem.

Ntawm cov ntxaij lim dej feem ntau yog:

• Los ntawm txoj cai: Lim tsuas yog HTTP, TCP, DNS, thiab lwm yam.
• Los ntawm IP chaw nyob: Piv txwv li, tso saib tsuas yog pob ntawv los ntawm lossis mus rau ib qho IP tshwj xeeb uas siv ip.src == 192.168.1.1 o ip.dst == 8.8.8.8.
• Los ntawm chaw nres nkoj: txwv cov txiaj ntsig mus rau qhov chaw nres nkoj tshwj xeeb (tcp.port == 80).
• Los ntawm kab ntawv: Nrhiav cov pob khoom uas muaj lo lus tseem ceeb hauv lawv cov ntsiab lus.
• Los ntawm MAC chaw nyob, pob ntawv ntev lossis IP ntau yam.

Tsis tas li ntawd, cov ntxaij lim dej tuaj yeem ua ke nrog cov tswv yim tsim nyog (thiab, or, tsis) rau kev tshawb nrhiav meej heev, xws li tcp.port == 80 and ip.src == 192.168.1.1.

Koj tuaj yeem ntes thiab txheeb xyuas dab tsi nrog Wireshark ntawm Windows?

Wireshark yog muaj peev xwm txhais tau ntau dua 480 cov txheej txheem sib txawv, los ntawm cov hauv paus zoo li TCP, UDP, IP, mus rau daim ntawv thov tshwj xeeb raws tu qauv, IoT, VoIP, thiab ntau lwm yam. Qhov no txhais tau tias koj tuaj yeem tshuaj xyuas txhua hom kev sib txuas hauv network, los ntawm cov lus nug DNS yooj yim mus rau kev sib tham SSH, HTTPS kev sib txuas, FTP hloov tsheb, lossis SIP tsheb los ntawm Internet xov tooj.

Ntxiv thiab, Wireshark txhawb nqa cov qauv kev ntes xws li tcpdump (libpcap), pcapng thiab lwm yam, thiab tso cai rau koj kom compress thiab decompress screenshots ntawm ya siv GZIP kom txuag chaw. Rau kev nkag mus encrypted (TLS/SSL, IPsec, WPA2, thiab lwm yam), yog tias koj muaj cov yuam sij, koj tuaj yeem decrypt cov ntaub ntawv thiab saib nws cov ntsiab lus qub.

Cov ncauj lus kom ntxaws tsheb khiav: cov lus pom zoo ntxiv

Ua ntej pib qhov kev ntes tseem ceeb, ua raws li cov txheej txheem no kom ua kom muaj txiaj ntsig zoo ntawm cov ntaub ntawv khaws tseg.:

• Xaiv qhov zoo interface: Feem ntau koj lub active adapter yuav yog ib qho rau kev sib txuas uas koj siv. Yog tias koj muaj lus tsis txaus siab, xyuas seb qhov twg yog txuas los ntawm Windows network teeb tsa.
• Teeb lub scene: Qhib tsuas yog cov kev pab cuam lossis cov apps uas yuav tsim cov tsheb uas koj xav txheeb xyuas.
• Cais qhov tshwm simYog tias koj tab tom nrhiav kev txheeb xyuas app tsheb, ua raws li cov kab ke no: tso lub app tom qab pib qhov kev ntes, ua qhov koj xav txheeb xyuas, thiab kaw lub app ua ntej tso tseg.
• Txuag lub screenshot: Tsis txhob kaw, mus rau Cov Ntaub Ntawv> Txuag thiab xaiv .pcap lossis koj nyiam hom ntawv.

Nov yog qhov koj yuav tau txais huv si thiab yooj yim rau kev txheeb xyuas cov ntaub ntawv, tsis muaj kev tsheb khiav tsis zoo sib xyaw.

Cov piv txwv piv txwv: kev tsom xam tsheb nrog Wireshark

Cia peb hais tias koj muaj ob lub khoos phis tawj ntawm koj lub network hauv zos thiab ib qho ntawm lawv nres nkag hauv Is Taws Nem. Koj tuaj yeem siv Wireshark los ntes cov tsheb khiav ntawm lub tshuab ntawd. thiab saib seb puas muaj qhov yuam kev los daws qhov chaw nyob DNS, yog tias pob ntawv tsis ncav cuag lub router, lossis yog firewall thaiv kev sib txuas lus.

Lwm qhov xwm txheej: tshawb xyuas yog tias lub vev xaib tsis zoo encrypt koj tus ID nkag mus. Yog tias koj nkag mus rau hauv lub vev xaib yam tsis muaj HTTPS thiab siv HTTP lim ua ke nrog koj tus neeg siv lub npe, koj tuaj yeem pom koj tus password taug kev hauv qhov pom tseeb ntawm lub network, ua qauv qhia lub neej tiag tiag ntawm kev pheej hmoo ntawm cov vev xaib tsis ruaj ntseg.

Wireshark thiab Kev Ruaj Ntseg: Kev pheej hmoo, kev tawm tsam, thiab kev tiv thaiv

Wireshark lub hwj chim kuj yog nws qhov kev pheej hmoo loj tshaj plaws: Hauv txhais tes tsis ncaj ncees lawm, nws tuaj yeem pab txhawb kev ntes, kev soj ntsuam, lossis nthuav tawm cov ntaub ntawv rhiab heev.. Nov yog qee qhov kev hem thawj thiab cov lus pom zoo:

• Credential stuffing (credential brute force attacks): Yog tias koj ntes SSH, Telnet, lossis lwm yam kev pabcuam kev pabcuam, koj tuaj yeem soj ntsuam kev nkag mus rau hauv kev sim. Ua tib zoo saib xyuas cov ntu ntev dua (lawv feem ntau ua tiav), pob ntawv qhov ntau thiab tsawg, thiab tus naj npawb ntawm kev sim kom pom cov qauv tsis txaus ntseeg.
• Kev pheej hmoo ntawm kev khiav tawm sab nraud: Lim tag nrho SSH kev khiav tsheb uas tsis yog los ntawm koj lub network sab hauv: yog tias koj pom kev sib txuas los ntawm sab nraud, ceeb toom!
• Plaintext passwords: Yog tias lub vev xaib xa cov npe siv tsis tau encrypted thiab passwords, koj yuav pom nws hauv lub screenshot. Tsis txhob siv Wireshark kom tau txais cov ntaub ntawv no ntawm txawv teb chaws tes hauj lwm. Nco ntsoov tias ua li ntawd yam tsis tau tso cai yog txhaum cai.
• Pom zoo thiab legality: Tsuas tshuaj xyuas kev khiav tsheb los ntawm tus kheej tes hauj lwm lossis nrog kev tso cai meej. Txoj cai lij choj no meej heev rau qhov no, thiab kev siv tsis raug tuaj yeem ua rau muaj qhov tshwm sim loj.
• Transparency thiab ethics: Yog tias koj ua haujlwm hauv ib puag ncig kev lag luam, qhia rau cov neeg siv txog kev tshuaj xyuas thiab nws lub hom phiaj. Kev hwm kev ceev ntiag tug tseem ceeb npaum li kev ruaj ntseg.

Wireshark Alternatives: Lwm Cov Kev Xaiv rau Kev Ntsuam Xyuas Network

Wireshark yog qhov kev siv tsis sib haum xeeb, tab sis muaj lwm yam cuab yeej uas tuaj yeem ntxiv lossis, nyob rau hauv cov xwm txheej tshwj xeeb, hloov nws siv:

• tcp pom: Zoo tagnrho rau Unix/Linux ib puag ncig, ua haujlwm ntawm kab hais kom ua. Nws yog lub teeb yuag, nrawm thiab hloov tau yooj yim rau kev ntes ceev lossis ua haujlwm ua haujlwm.
• Cloudshark: Lub vev xaib platform rau uploading, txheeb xyuas, thiab sib qhia pob ntawv ntes los ntawm browser. Muaj txiaj ntsig zoo rau kev sib koom ua ke ib puag ncig.
• SmartSniff: Tsom ntsoov rau Windows, yooj yim siv rau qhov chaw ntes thiab saib kev sib tham ntawm cov neeg siv khoom thiab cov servers.
• ColaSoft Capsa: Graphical network analyzer uas sawv tawm rau qhov yooj yim ntawm nws cov interface thiab cov kev xaiv tshwj xeeb rau chaw nres nkoj scanning, exporting, thiab compact visualization.

Xaiv qhov kev xaiv zoo tshaj plaws nyob ntawm koj qhov kev xav tau tshwj xeeb.: ceev, graphical interface, online sib koom tes, los yog compatibility nrog tej yam kho vajtse.

Advanced Settings: Promiscuous Mode, Monitor, and Name Resolution

Promiscuous hom tso cai rau lub network card ntes tsis tsuas yog cov pob khoom npaj rau nws, tab sis tag nrho cov tsheb khiav los ntawm lub network uas nws txuas nrog. Nws yog ib qho tseem ceeb rau kev txheeb xyuas cov koom tes sib koom tes, sib koom hubs, los yog pentesting scenarios.

Hauv Windows, mus rau Capture > Options, xaiv lub interface thiab kos lub thawv hom promiscuous. Nco ntsoov tias ntawm Wi-Fi tes hauj lwm, tshwj tsis yog rau cov khoom siv tshwj xeeb, koj tsuas yog pom kev khiav tsheb los ntawm koj tus kheej lub cuab yeej.

Rau lwm cov tes, Lub npe daws teeb meem hloov IP chaw nyob rau hauv cov npe sau tau nyeem tau (piv txwv li, 8.8.8.8 hauv google-public-dns-a.google.com). Koj tuaj yeem pab lossis lov tes taw qhov kev xaiv no los ntawm Kho kom raug> Nyiam> Lub Npe daws teeb meem. Nws pab tau ntau yam los txheeb xyuas cov khoom siv thaum lub sijhawm luam theej duab, txawm hais tias nws tuaj yeem ua rau qeeb qeeb yog tias muaj ntau qhov chaw nyob raug daws.