Momwe mungagwiritsire ntchito Wireshark kuti muwone mavuto a netiweki

Ngati mumagwira ntchito pamanetiweki, chitetezo, kapena chitukuko ndipo mukufuna kumvetsetsa zomwe zikuchitika pazingwe zanu ndi Wi-Fi, mukugwira ntchito ndi Wireshark Ndi chinthu chofunikira. Izi Open source package analyzer ndi zaka zambiri zachisinthiko zomwe zimalola kulanda, kugawanitsa ndi kuphunzira magalimoto pamtunda wa paketi ndi opaleshoni yolondola.

M'nkhaniyi tikusanthula mozama: kuchokera ku layisensi yake ndi chithandizo chake kupita ku GNU/Linux, kuphatikiza zida zolumikizirana, mawonekedwe othandizidwa, zofunikira pakuphatikiza, zilolezo zojambulira komanso kuwunika kokwanira kwa mbiri yakale komanso magwiridwe antchito.

Kodi Wireshark ndi chiyani ndipo amagwiritsidwa ntchito masiku ano?

M'malo mwake, Wireshark ndi a protocol analyzer ndi chida chojambulira magalimoto zomwe zimakupatsani mwayi woyika mawonekedwe achiwerewere kapena kuwunika (ngati makinawo amathandizira) ndikuwona mafelemu omwe sangatumizidwe ku Mac yanu, santhulani zokambirana, sinthaninso mayendedwe, mapaketi amitundu molingana ndi malamulo, ndikugwiritsa ntchito zosefera zowonetsera kwambiri. Komanso, zikuphatikiza TShark (terminal version) ndi zida zogwirira ntchito monga kuyitanitsanso, kugawa, kuphatikiza, ndikusintha zithunzi.

Ngakhale kugwiritsidwa ntchito kwake kumakumbutsa za tcpdump, kumapereka mawonekedwe amakono ozikidwa pa Qt ndi kusefa, kusanja, ndi kupatukana kwambiri kwa masauzande a protocol. Ngati muli pa switch, kumbukirani kuti kuchita chiwerewere sikukutsimikizirani kuti mudzawona kuchuluka kwa magalimoto: kuti muwonetsetse zonse mudzafunika magalasi owonera kapena matepi a netiweki, zomwe zolemba zawo zimatchulanso kuti ndizochita zabwino.

License, maziko ndi chitukuko

Wireshark imagawidwa pansi GNU GPL v2 ndi m'malo ambiri, monga "GPL v2 kapena kenako". Zina zomwe zili mu code source zili ndi zilolezo pansi pa malaisensi osiyanasiyana koma ogwirizana, monga chida cha pidl chokhala ndi GPLv3+, chomwe sichimakhudza gulu la analyzer. Palibe chitsimikizo chofotokozera kapena chofotokozera; gwiritsani ntchito mwakufuna kwanu, monga mwachizolowezi ndi pulogalamu yaulere.

La Wireshark Foundation Imagwirizanitsa chitukuko ndi kugawa. Zimadalira zopereka zochokera kwa anthu ndi mabungwe omwe ntchito zawo zimachokera ku Wireshark. Ntchitoyi ili ndi zikwizikwi za olemba olembetsedwa komanso anthu odziwika bwino monga Gerald Combs, Gilbert Ramirez, ndi Guy Harris pakati pa othandizira ake otchuka.

Wireshark imayenda pa Linux, Windows, macOS, ndi machitidwe ena a Unix (BSD, Solaris, etc.). Maphukusi ovomerezeka amamasulidwa a Windows ndi macOS, ndipo pa GNU/Linux nthawi zambiri amaphatikizidwa ngati phukusi lokhazikika kapena lowonjezera pamagawidwe monga Debian, Ubuntu, Fedora, CentOS, RHEL, Arch, Gentoo, openSUSE, FreeBSD, DragonFly BSD, NetBSD, ndi OpenBSD. Imapezekanso pa machitidwe a chipani chachitatu monga Homebrew, MacPorts, pkgsrc kapena OpenCSW.

Kuti muphatikize kuchokera pamakhodi, mufunika Python 3; AsciiDoctor kwa zolemba; ndi zida monga Perl ndi GNU flex (lex yapamwamba sigwira ntchito). Kukonzekera pogwiritsa ntchito CMake kumakupatsani mwayi wothandizira kapena kuletsa thandizo linalake, mwachitsanzo, kukakamiza malaibulale okhala ndi -DENABLE_ZLIB=KUCHOKERA, -DENABLE_LZ4=KUCHOKERA kapena -DENABLE_ZSTD=KUTHA, kapena thandizo la libsmi ndi -DENABLE_SMI=OFF ngati simukufuna kukweza ma MIB.

Phukusi ndi malaibulale mumayendedwe a Debian

Mu Debian/Ubuntu ndi malo otuluka, Wireshark ecosystem imagawidwa angapo phukusiM'munsimu muli kusokonezeka kwa mawonekedwe, kukula kwake, ndi kudalira. Maphukusiwa amakulolani kuti musankhe kuchokera ku GUI yathunthu kupita ku malaibulale ndi zida zachitukuko zophatikizira ma dissections muzogwiritsa ntchito zanu.

wireshark

Ntchito yojambula yojambula ndikusanthula kuchuluka kwa magalimoto ndi mawonekedwe a Qt. Chiyerekezo kukula: 10.59 MB. Malo: sudo apt install wireshark

Pakati pa zosankha zake zoyambira mupeza magawo oti musankhe mawonekedwe (-i), jambulani zosefera (-f), malire azithunzi, mawonekedwe owunikira, mindandanda yamtundu wa ulalo, zosefera (-Y), "Decode As" ndi zokonda, komanso mawonekedwe amtundu wa mafayilo ndikujambula ndemanga. Ntchito imalolanso kamangidwe kambiri ndi ziwerengero zida zapamwamba kuchokera ku mawonekedwe.

tchark

Mtundu wa Console wa kujambula ndi kusanthula mzere wamalamulo. Kuyerekeza kukula: 429 KB. Malo: sudo apt install tshark

Zimakupatsani mwayi wosankha ma interfaces, kugwiritsa ntchito zosefera zojambulira ndikuwonetsa, kufotokozerani zoyimitsa (nthawi, kukula, kuchuluka kwa mapaketi), gwiritsani ntchito ma buffers ozungulira, tsatanetsatane wosindikiza, kutaya kwa hex ndi JSON, ndikutumiza zinthu za TLS ndi makiyi. Ikhozanso kukongoletsa zotuluka mu terminal yogwirizana. sinthani kudula mitengo ndi madambwe ndi magawo atsatanetsatane. Chenjezo limalangizidwa ngati muthandizira BPF JIT pamlingo wa kernel, chifukwa zitha kukhala ndi chitetezo.

wireshark - wamba

Mafayilo wamba a wireshark ndi tshark (mwachitsanzo, madikishonale, masinthidwe, ndi zida zamzere). Chiyerekezo kukula: 1.62 MB. Malo: sudo apt install wireshark-common

Phukusili lili ndi zofunikira monga capinfo (jambulani zambiri zamafayilo: mtundu, ma encapsulation, nthawi, mitengo, makulidwe, ma hashes ndi ndemanga), captype (zindikirani mitundu yamafayilo), dumpcap (chida chojambulira chopepuka chomwe chimagwiritsa ntchito pcapng/pcap chokhala ndi autostop ndi zozungulira zozungulira), editcap (Sinthani/Gawani/Sinthani zojambulidwa, sinthani masitampu anthawi, chotsani zobwereza, onjezani ndemanga kapena zinsinsi), kuphatikiza (phatikizani kapena phatikizani zojambula zambiri), mmdbresolve (thetsani IP geolocation ndi MMDB database), randpkt (generator synthetic paketi yamitundu yambiri), rawshark (kuwonongeka kopanda pake ndi zotuluka m'munda), reordercap (konzaninso ndi sitepe yanthawi), sharkd (daemon yokhala ndi API yokonza zojambulidwa) ndi mawu2pcap (sinthani ma hexdumps kapena zolemba zosanjidwa kukhala zojambulidwa zovomerezeka).

libwireshark18 ndi libwireshark-data

Library yapakati pakiti dissection. Amapereka ma analyzer a protocol omwe amagwiritsidwa ntchito ndi Wireshark/TShark. Pafupifupi kukula kwa laibulale: 126.13 MB. Malo: sudo apt install libwireshark18 y sudo apt install libwireshark-data

Zimaphatikizapo kuthandizira ma protocol ambiri ndi zosankha monga kupatsa kapena kuletsa ma dissections, ma heuristics, ndi "Decode As" kuchokera pamawonekedwe kapena pamzere wolamula; chifukwa cha izi, mutha kusintha kugawanika kwa magalimoto enieni za chilengedwe chanu.

libwiretap15 ndi libwiretap-dev

Wiretap ndi laibulale yowerengera ndikulemba mafayilo angapo ojambulira. Mphamvu zake ndi mitundu yosiyanasiyana yomwe imathandizira; malire ake ndi: Simasefa kapena kujambula mwachindunji.. Malo: sudo apt install libwiretap15 y sudo apt install libwiretap-dev

Kusiyana kwa -dev kumapereka laibulale yosasunthika ndi mitu ya C kuti aphatikize zowerengera / kulemba mu zida zanu. Izi zimakupatsani mwayi wopanga zida zomwe zimagwiritsa ntchito data. pcap, pcapng ndi zotengera zina monga gawo la mapaipi athu.

libwsutil16 ndi libwsutil-dev

Gulu lazinthu zothandizira Wireshark ndi malaibulale ofananira nawo: ntchito zothandizira pakuwongolera zingwe, kubisa, kubisa, ndi zina. Kuyika: sudo apt install libwsutil16 y sudo apt install libwsutil-dev

Phukusi la -dev limaphatikizapo mitu ndi laibulale yosasunthika kuti mapulogalamu akunja athe kulumikiza zofunikira wamba popanda kukonzanso mawilo. Ndi maziko a ntchito zambiri zogawana omwe amagwiritsa ntchito Wireshark ndi TShark.

wireshark-dev

Zida ndi mafayilo opangira "dissectors" atsopano. Imapereka zolemba ngati idl2wrs, komanso kudalira pakulemba ndi kuyesa. Kuyerekeza kukula: 621 KB. Malo: sudo apt install wireshark-dev

Zimaphatikizapo zofunikira monga ndi 2deb (amapanga phukusi la Debian la kuwunika kwa BER kuchokera ku ASN.1) ndi ndi 2deb (maphukusi a CORBA). Ndipo koposa zonse, ndi 2wrsChida ichi chimasintha CORBA IDL kukhala chigoba cha pulogalamu yowonjezera ya C pochotsa magalimoto a GIOP/IIOP. Kuyenda uku kumadalira zolemba za Python (wireshark_be.py ndi wireshark_gen.py) ndipo zimathandizira kugawanika kwa heuristic mwachisawawa. Chidacho chimasaka ma module ake mu PYTHONPATH/masamba-package kapena m'ndandanda wamakono, ndikuvomereza kuwongolera mafayilo kuti apange code.

wireshark-doc

Zolemba za ogwiritsa ntchito, kalozera wachitukuko ndi kalozera wa Lua. Chiyerekezo kukula: 13.40 MB. Malo: sudo apt install wireshark-doc

Ndibwino ngati mukufuna kuzama mozama extensions, scripting ndi APIsZolemba zapaintaneti patsamba lovomerezeka zimasinthidwa ndi mtundu uliwonse wokhazikika.

Kujambula ndi zilolezo zachitetezo

M'makina ambiri, kujambula mwachindunji kumafuna mwayi wapamwamba. Pachifukwa ichi, Wireshark ndi TShark nthumwi zimagwira ntchito ya chipani chachitatu. dumpcapBinary yopangidwa kuti iziyenda ndi mwayi (set-UID kapena luso) kuti muchepetse kuwukira. Kuthamanga GUI yonse ngati muzu sikuchita bwino; ndibwino kujambula ndi dumpcap kapena tcpdump ndikusanthula popanda mwayi kuti muchepetse zoopsa.

Mbiri ya pulojekitiyi imaphatikizapo zochitika zachitetezo m'ma dissectors pazaka zambiri, ndipo nsanja zina monga OpenBSD zinasiya ntchito yakale ya Ethereal pazifukwa zake. Ndichitsanzo chomwe chilipo, kudzipatula pa kugwidwa ndi kusinthidwa kosalekeza kumapangitsa kuti zinthu zikhale bwino, koma nthawi zonse zimakhala bwino tsatirani malangizo achitetezo Ndipo, ngati muwona zochitika zokayikitsa, dziwani letsani maukonde okayikitsa ndikupewa kutsegula zithunzi zosadalirika popanda kuwunikiranso.

Mawonekedwe a fayilo, kukanikizana, ndi mafonti apadera

Wireshark amawerenga ndikulemba pcap ndi pcapng, komanso mawonekedwe ochokera kwa osanthula ena monga snoop, Network General Sniffer, Microsoft Network Monitor, ndi ambiri omwe alembedwa ndi Wiretap pamwambapa. Itha kutsegula mafayilo othinikizidwa ngati adapangidwa ndi malaibulale a pcapng. GZIP, LZ4 ndi ZSTDMakamaka, GZIP ndi LZ4 yokhala ndi midadada yodziyimira pawokha imalola kulumpha mwachangu, kuwongolera magwiridwe antchito a GUI pakujambula kwakukulu.

Zolemba za polojekitiyi zimakhala ndi AIX iptrace (komwe HUP ku daemon imatseka bwino), kuthandizira maulendo a Lucent / Ascend, Toshiba ISDN kapena CoSine L2, ndikuwonetsa momwe mungajambulire zolembazo ku fayilo (mwachitsanzo, ndi telnet <equipo> | tee salida.txt kapena kugwiritsa ntchito script) kuti mulowetse pambuyo pake ndi text2pcap. Njira izi zimakuchotsani "zachizolowezi" zojambulidwa mukamagwiritsa ntchito zida zomwe sizikuyenda mwachindunji pa pcap.

Ma suites ndi magawo omwe mungasankhe

Kuphatikiza pa Wireshark ndi TShark, kugawa kumaphatikizapo zida zingapo zomwe zimagwira ntchito zenizeniPopanda kukopera mawu achidule, nayi chidule chokonzedwa ndi magulu kuti mudziwe zomwe aliyense amachita komanso zomwe mungapeze:

• dumpcap: "zoyera ndi zosavuta" pcap / pcapng kujambula, kusankha mawonekedwe, zosefera za BPF, kukula kwa buffer, kuzungulira ndi nthawi / kukula / mafayilo, kupanga ma buffer a mphete, kujambula ndemanga ndi zotuluka mumtundu makina owerengekaImachenjeza za kuyambitsa JIT ya BPF chifukwa cha zoopsa zomwe zingachitike.
• capinfoImawonetsa mtundu wa fayilo, encapsulation, interfaces, ndi metadata; chiwerengero cha mapaketi, kukula kwa fayilo, kutalika konse, malire a chithunzithunzi, nthawi (yoyamba / yotsiriza), mitengo yapakati (bps / Bps / pps), kukula kwa paketi, ma hashes, ndi ndemanga. Zimalola kuti pakhale ma tabular kapena mwatsatanetsatane komanso mawonekedwe owerengeka ndi makina.
• captype: imazindikiritsa mtundu wa fayilo yojambulidwa ya cholembera chimodzi kapena zingapo mothandizidwa ndi zosankha zamasinthidwe.
• editcapImasankha / imachotsa mapaketi a paketi, snaps / chops, imasintha ma timestamp (kuphatikiza dongosolo lokhazikika), imachotsa zobwerezedwa ndi mazenera osinthika, imawonjezera ndemanga pa chimango, imagawanitsa ndi nambala kapena nthawi, imasintha chidebe ndi encapsulation, imagwira ntchito ndi zinsinsi za decryption, ndi compresses linanena bungwe. Ndilo chida chacholinga chonse chojambulira "kuyeretsa".
• kuphatikiza: imaphatikiza zojambula zingapo kukhala imodzi, mwina ndi kuphatikizika kwa mzere kapena kusanganikirana kwanthawi, kuwongolera snaplen, kumatanthawuza mtundu wotulutsa, mawonekedwe ophatikiza a IDB ndi kuphatikizika komaliza.
• reordercap: kuyitanitsanso fayilo ndi sitepe yanthawi yomwe imapanga zotuluka zoyera ndipo, ngati yasankhidwa kale, ingapewe kulemba zotsatira zake kuti musunge I/O.
• mawu2pcap: amasintha ma hexdumps kapena zolemba ndi regex kuti zigwire zovomerezeka; imazindikira zosinthika m'malo osiyanasiyana, ma timestamp okhala ndi mawonekedwe a strptime (kuphatikiza kulondola kwapang'onopang'ono), imazindikira ASCII yolumikizidwa ngati ikuyenera, ndipo imatha kukonzekereratu mitu ya "dummy" (Ethernet, IPv4/IPv6, UDP/TCP/SCTP, EXPORTED_PDU) ndi madoko, ma adilesi, ndi zilembo anasonyeza.
• rawshark: "yaiwisi" wowerenga wongoyang'ana kumunda; limakupatsani mwayi woyika encapsulation kapena dissection protocol, kuletsa kusamvana kwa mayina, kuyika zosefera zowerengera / zowonetsa ndikusankha mtundu wamtundu wamunda, wothandiza pamapaipi ndi zida zina.
• randpktAmapanga mafayilo okhala ndi mapaketi mwachisawawa amitundu monga ARP, BGP, DNS, Efaneti, IPv4/IPv6, ICMP, TCP/UDP, SCTP, Syslog, USB-Linux, ndi zina zotero, kufotokoza akaunti, kukula kwake, ndi chidebe. Zabwino kwa mayeso ndi ma demo.
• mmdbresolve: Query MaxMind databases (MMDB) kuti asonyeze malo a IPv4/IPv6 maadiresi, kutchula fayilo imodzi kapena zingapo za database.
• sharkd: daemon yomwe imawonetsa API (mode "golide") kapena socket yachikale (mode "classic"); imathandizira ma profiles osinthika ndipo imayang'aniridwa kuchokera kwa makasitomala a seva-side dissection ndi kusaka, zothandiza popanga zokha ndi ntchito.

Zomangamanga, makhalidwe ndi malire

Wireshark amadalira libpcap/Npcap kuti agwire, komanso pa chilengedwe cha malaibulale (libwireshark, libwiretap, libwsutil) omwe amalekanitsa dissection, mawonekedwe, ndi zofunikira. Imalola kuzindikira kuyimba kwa VoIP, kuseweredwa kwamawu mumasinthidwe othandizidwa, kugwidwa kwa magalimoto a USB, ndikusefa pamanetiweki a Wi-Fi (ngati adutsa pa Ethernet). mapulagini a ma protocol atsopano olembedwa mu C kapena Lua. Ithanso kulandira kuchuluka kwa magalimoto akutali (mwachitsanzo, TZSP) pakuwunika zenizeni kuchokera kumakina ena.

Si IDS, komanso sizipereka zidziwitso; ntchito yake ndi yongokhala: imayang'ana, imayesa, ndikuwonetsa. Ngakhale zili choncho, zida zothandizira zimapereka ziwerengero ndi kayendedwe ka ntchito, ndipo zida zophunzitsira zimapezeka mosavuta (kuphatikiza mapulogalamu ophunzirira omwe amayang'ana chaka cha 2025 omwe amaphunzitsa zosefera, kununkhiza, zolemba zala za OS, kusanthula nthawi yeniyeni, zodziwikiratu, magalimoto osungidwa, komanso kuphatikiza ndi machitidwe a DevOps). Gawo la maphunziro ili likukwaniritsa ntchito yayikulu ya kuzindikira ndi kuthetsa mavuto.

Kugwirizana ndi chilengedwe

Zomangamanga ndi kuyesa nsanja zikuphatikizapo Linux (Ubuntu), Windows ndi macOSPulojekitiyi imatchulanso kuyanjana kwakukulu ndi machitidwe owonjezera a Unix ndi kugawa kudzera mwa oyang'anira chipani chachitatu. Nthawi zina, mitundu yakale ya OS imafuna nthambi zam'mbuyomu (mwachitsanzo, Windows XP yokhala ndi mtundu 1.10 kapena woyambirira). Nthawi zambiri, mutha kukhazikitsa kuchokera kumalo osungira ovomerezeka kapena ma binaries m'malo ambiri popanda zovuta zazikulu.

Amaphatikizana ndi ma network simulators (ns, OPNET Modeler), ndi zida za chipani chachitatu (mwachitsanzo, Aircrack ya 802.11) zitha kugwiritsidwa ntchito kupanga zojambula zomwe Wireshark amatsegula popanda zovuta. M'malo mwa malamulo okhwima ndi makhalidwe abwinoKumbukirani kungojambula pamanetiweki ndi zochitika zomwe muli ndi chilolezo chofotokozera.

Dzina, masamba ovomerezeka, ndi data yowongolera

Webusaiti yovomerezeka ndi wireshark.orgndi kutsitsa mu subdirectory yake / kutsitsa ndi zolemba zapaintaneti za ogwiritsa ntchito ndi opanga. Pali masamba okhala ndi ulamuliro waulamuliro (mwachitsanzo, GND) ndi mindandanda yamalumikizidwe osungira ma code, tracker bug, ndi blog blog, yothandiza pakusunga nkhani ndi malipoti.

Musanayambe kujambula, tsimikizirani zilolezo ndi kuthekera kwa makina anu, sankhani ngati mungagwiritse ntchito dumpcap/tcpdump kutaya ku disk ndikusanthula popanda mwayi, ndikukonzekera zosefera ndikuwonetsa zomwe zikugwirizana ndi cholinga chanu. Ndi njira yabwino, Wireshark imathandizira zovutazo ndikukupatsirani chidziwitso choyenera. Chiwonetsero chomwe mukufuna kuti muzindikire, kuphunzira, kapena kuunika maukonde amtundu uliwonse.

Nkhani yowonjezera:

Zoyenera kuchita m'maola 24 oyambirira mutatha kuthyolako: mafoni, PC ndi akaunti zapaintaneti

Daniel Terrasa

Mkonzi wokhazikika pazaukadaulo komanso nkhani zapaintaneti yemwe ali ndi zaka zopitilira khumi pazama media osiyanasiyana. Ndagwira ntchito ngati mkonzi komanso wopanga zinthu pa e-commerce, kulumikizana, kutsatsa pa intaneti ndi makampani otsatsa. Ndalembanso pamawebusayiti azachuma, azachuma ndi magawo ena. Ntchito yanga ndi chidwi changanso. Tsopano, kudzera mu zolemba zanga mu Tecnobits, Ndimayesetsa kufufuza nkhani zonse ndi mwayi watsopano umene dziko laukadaulo limatipatsa tsiku lililonse kuti tisinthe miyoyo yathu.