Fa'afefea ona fa'aoga Wireshark e iloa ai fa'afitauli feso'otaiga

Afai e te galue i upega tafailagi, saogalemu, poʻo le atinaʻe ma e te manaʻo e malamalama i mea o loʻo tupu i luga o au uaea ma Wi-Fi, galue ma Wireshark O se elemene taua. Lenei su'esu'e pusa puna tatala faatasi ai ma le tele o tausaga o le evolusione e mafai ai ona pu'e, va'ava'ai ma su'esu'e felauaiga i le tulaga o le pa'u ma le sa'o sa'o o taotoga.

I totonu o lenei tusiga matou te auiliiliina loloto: mai lona laisene ma le lagolago i ana afifi i le GNU/Linux, e aofia ai faʻamafanafanaga aoga, faʻapipiʻi lagolago, tuʻufaʻatasiga manaʻoga, faʻatagaga puʻeina ma se faʻamatalaga atoatoa faʻasolopito ma galuega.

O le a le Wireshark ma o le a le mea e faʻaaogaina mo aso nei?

O lona uiga, Wireshark o se su'esu'e fa'akomepiuta ma masini pu'e fe'avea'i lea e mafai ai ona e tuʻuina se atinaʻe i le faʻafefe poʻo le mataʻituina tulaga (pe a lagolagoina e le polokalama) ma vaʻai faʻavaa e le lafoina i lau Mac, auʻiliʻili talanoaga, toe faʻaleleia tafega, lanu paʻu e tusa ai ma tulafono, ma faʻaoga faʻaaliga faʻaalia manino. E lē gata i lea, e aofia ai TShark (faiga fa'aumu) ma se seti o aoga mo galuega e pei o le toe faʻatulagaina, vaeluaina, tuʻufaʻatasia, ma le liliuina o screenshots.

E ui lava o lona faʻaogaina e faʻamanatuina le tcpdump, e maua ai se faʻataʻitaʻiga faʻaonaponei faʻaonaponei e faʻavae ile Qt ma fa'amama, fa'avasega, ma fa'a'ese'ese loloto mo le faitau afe o protocols. Afai o lo'o e i luga o se ki, ia manatua e le fa'amautinoaina e le faiga fa'akomepiuta e te va'ai uma i fe'avea'iga: mo fa'ata'ita'iga atoatoa e te mana'omia le fa'ata o le taulaga po'o le pa'u feso'ota'iga, lea o lo'o ta'ua fo'i e latou fa'amaumauga o faiga sili.

Laisene, fa'avae ma fa'ata'ita'iga

Wireshark o loʻo tufatufaina i lalo GNU GPL v2 ma i le tele o nofoaga, e pei o le "GPL v2 pe mulimuli ane". O nisi mea aoga i le source code ua laiseneina i lalo o laisene eseese ae fetaui, e pei o le meafaigaluega pidl ma le GPLv3+, lea e le afaina ai le taunuuga o le binary o le auiliiliga. E leai se fa'amaoniga fa'aalia pe fa'amaonia; fa'aaoga i lou lava tulaga lamatia, e pei ona masani ai i polokalama faakomepiuta saoloto.

La Wireshark Foundation E faamaopoopoina le atina'e ma le tufatufaina. E faʻalagolago i foaʻi mai tagata taʻitoʻatasi ma faʻalapotopotoga o latou galuega e faʻavae i Wireshark. O le poloketi o loʻo faʻaalia ai le faitau afe o tusitala resitala ma tagata faʻasolopito e pei o Gerald Combs, Gilbert Ramirez, ma Guy Harris i totonu o ana lagolago sili ona lauiloa.

Wireshark e tamo'e i Linux, Windows, macOS, ma isi faiga fa'atusa Unix (BSD, Solaris, ma isi). O faʻasalalauga aloaʻia e tuʻuina atu mo Windows ma macOS, ma i luga ole GNU/Linux e masani ona aofia ai o se pusa faʻapipiʻi poʻo se faʻaopoopoga i tufatufaga e pei o Debian, Ubuntu, Fedora, CentOS, RHEL, Arch, Gentoo, openSUSE, FreeBSD, DragonFly BSD, NetBSD, ma OpenBSD. O lo'o maua fo'i i faiga fa'a-tolu e pei o Homebrew, MacPorts, pkgsrc poʻo OpenCSW.

Ina ia tuufaatasia mai le code, e te manaʻomia le Python 3; AsciiDoctor mo faʻamaumauga; ma meafaigaluega e pei o Perl ma GNU flex (o le lex masani e le aoga). O le fa'aogaina o le CMake e fa'atagaina ai oe e fa'atagaina pe fa'amalo le lagolago fa'apitoa, mo se fa'ata'ita'iga, faletusi fa'amalosi ma -DENABLE_ZLIB=OFF, -DENABLE_LZ4=OFF po'o -DENABLE_ZSTD=OFF, po'o le libsmi lagolago i le -DENABLE_SMI=OFF pe afai e te mana'o e le utaina MIBs.

Paketi ma faletusi i faiga faʻavae Debian

I Debian/Ubuntu ma siosiomaga e maua mai, o le Wireshark ecosystem ua vaevaeina i tele afifiO lo'o i lalo se va'aiga fa'atasi ma foliga, fa'atatau o lapopo'a, ma fa'alagolago. O nei afifi e mafai ai ona e filifili mai se GUI atoatoa i faletusi ma meafaigaluega faʻaleleia mo le tuʻufaʻatasia o faʻasalalauga i au lava talosaga.

telefoni

Fa'ata'ita'iga fa'akomepiuta mo le pu'eina ma le au'ili'ili o fefa'ataua'iga fa'atasi ai ma se feso'ota'iga Qt. Tala fa'atatau: 10.59 MB. Fale: sudo apt install wireshark

Faatasi ai ma ana filifiliga amata o le ae maua ai ni tapulaʻa e filifili ai le atinaʻe (-i), pu'e filiga (-f), tapula'a ata, faiga mata'itu, lisi ituaiga feso'ota'iga, fa'aaliga filiga (-Y), "Decode As" ma mea e fiafia i ai, faʻapea foʻi ma faila faila ma faʻamatalaga puʻeina. E mafai foi e le talosaga fa'asologa fa'asologa ma fa'amaumauga foliga maualuga mai le atinaʻe.

malie

Console version mo le pu'eina ma le au'ili'iliga o laina fa'atonu. Tala fa'atatau: 429 KB. Fale: sudo apt install tshark

E mafai ai e oe ona filifili fesoʻotaʻiga, faʻaoga le puʻeina ma faʻaalia filiga, faʻamalamalamaina tulaga taofi (taimi, lapopoa, numera o paʻu), faʻaoga paʻu liʻo, faʻamatalaga lolomi, faʻamalo hex ma JSON, ma faʻatau atu mea TLS ma ki. E mafai fo'i ona valivali le mea e fai i totonu o se laina fa'aoga talafeagai. fetu'utu'una'i le fa'amauina o ogalaau e ala i vaega ma tulaga o auiliiliga. E fautuaina le fa'aeteete pe afai e te fa'aogaina le BPF JIT ile maualuga ole fatu, ona e ono iai ni a'afiaga ole saogalemu.

wireshark-masani

Faila masani mo wireshark ma tshark (fa'ata'ita'iga, lomifefiloi, fetuutuunaiga, ma laina aoga). Tala fa'atatau: 1.62 MB. Fale: sudo apt install wireshark-common

O lenei afifi e aofia ai mea aoga e pei o capinfos (Pu'e fa'amatalaga faila: ituaiga, fa'apipi'i, umi, fua, lapopo'a, fa'ailoga ma fa'amatalaga), mata'itusi (faailoa ituaiga faila), lapisi (masini mama pu'e e fa'aogaina le pcapng/pcap fa'atasi ai ma le autostop ma fa'ata'ali'oli'o pa'u), editcap (fa'asa'o/vaevae/fa'aliliu pu'e, fetu'una'i taimi fa'ailoga, aveese fa'alua, fa'aopoopo fa'amatalaga po'o mealilo), mergecap (tu'u fa'atasi pe tu'ufa'atasia ni pu'ega se tele), mmdbresolve (foia IP geolocation ma MMDB database), randpkt (multi-protocol synthetic packet generator), rawshark (vaega fa'atauva'a fa'atasi ma galuega fa'atino), reordercap (toe faatulaga e ala i le faailoga taimi), sharkd (daemon faʻatasi ma API e faʻatautaia puʻeina) ma text2pcap (faaliliuina hexdumps po'o tusitusiga fa'atulagaina i ni pu'ega aoga).

libwireshark18 ma libwireshark-data

Faletusi tu'ufa'atasiga fa'atotonugalemu. Tuuina atu suʻesuʻega faʻasalalauga faʻaaogaina e Wireshark/TShark. Fa'atatau ile faletusi: 126.13 MB. Fale: sudo apt install libwireshark18 y sudo apt install libwireshark-data

E aofia ai le lagolago mo le tele o faʻasalalauga ma filifiliga e pei o le faʻatagaina poʻo le faʻagataina o faʻasalalauga faʻapitoa, heuristics, ma le "Decode As" mai le atinaʻe poʻo le laina faʻatonu; faafetai i lenei, e mafai ona e fetuunai le vaeluaga o feoaiga moni o lou siosiomaga.

libwiretap15 ma libwiretap-dev

O le Wiretap o se faletusi mo le faitau ma le tusiaina o le tele o faila faila. O lona malosi o le eseese o faʻatulagaga e lagolagoina; ona tapulaa o: E le fa'amama pe fa'atinoina le pu'eina sa'o.. Fale: sudo apt install libwiretap15 y sudo apt install libwiretap-dev

O le -dev variant e maua ai le faletusi faʻamau ma C ulutala e tuʻufaʻatasia le faitau / tusitusi gaioiga i au meafaigaluega. Ole mea lea e mafai ai e oe ona atia'e mea faigaluega e fa'aogaina fa'amaumauga. pcap, pcapng ma isi koneteina o se vaega oa tatou lava paipa.

libwsutil16 ma libwsutil-dev

O se seti o mea aoga fa'asoa e Wireshark ma faletusi fa'atasi: galuega fesoasoani mo le fa'aogaina o manoa, fa'afefe, fa'ailoga, ma isi. Fa'apipi'i: sudo apt install libwsutil16 y sudo apt install libwsutil-dev

O le -dev package e aofia ai ulutala ma se faletusi faʻamau ina ia mafai e faʻaoga fafo ona fesoʻotaʻi faʻaoga masani e aunoa ma le toe faʻaaogaina o uili. O le faavae o tele galuega fa'asoa e faʻaaoga Wireshark ma TShark.

wireshark-dev

Meafaigaluega ma faila mo le fatuina o "dissectors" fou. E tuʻuina atu tusitusiga e pei o idl2wrs, faʻapea foʻi ma faʻalagolago mo le tuʻufaʻatasia ma suʻega. Tala fa'atatau: 621 KB. Fale: sudo apt install wireshark-dev

E aofia ai mea aoga e pei o asn2deb (fausia afifi Debian mo le mataituina BER mai ASN.1) ma idl2deb (faiga mo CORBA). Ma, sili atu i mea uma, idl2wrsO lenei meafaigaluega e suia ai se CORBA IDL i totonu o le auivi o se masini C mo le faʻavasegaina o fefaʻatauaiga GIOP/IIOP. O lenei galuega e fa'alagolago i tusitusiga a le Python (wireshark_be.py ma wireshark_gen.py) ma lagolagoina le fa'amavaega o le heuristic e ala i le faaletonu. E su'e e le meafaigaluega ona modules i totonu PYTHONPATH/site-packages po'o totonu o le lisi o lo'o iai nei, ma talia le toe fa'atonuina o faila e fa'atupu ai le code.

wireshark-doc

Fa'amaumauga a le tagata fa'aoga, ta'iala tau atina'e ma fa'amatalaga Lua. Tala fa'atatau: 13.40 MB. Fale: sudo apt install wireshark-doc

Fautuaina pe afai o le a e su'esu'e loloto i ai fa'aopoopoga, tusitusiga ma APIO faʻamaumauga i luga ole laiga ile upega tafaʻilagi aloaia e faʻafouina i faʻamaumauga mautu taʻitasi.

Pu'e ma pemita saogalemu

I le tele o faiga, o le pu'eina sa'o e mana'omia ai avanoa maualuluga. Mo lenei mafuaʻaga, Wireshark ma TShark tuʻuina atu le puʻeina i se auaunaga lona tolu. lapisiO se binary ua fuafuaina e tamoʻe ma avanoa (set-UID poʻo gafatia) e faʻaitiitia ai le osofaʻiga. O le faʻatinoina o le GUI atoa e pei o aʻa e le o se faʻataʻitaʻiga lelei; e sili le pu'eina i le dumpcap po'o le tcpdump ma au'ili'ili e aunoa ma ni fa'amanuiaga e fa'aitiitia ai lamatiaga.

O le talaʻaga o le poloketi e aofia ai faʻalavelave faʻalavelave i tagata faʻasalalau i le tele o tausaga, ma o nisi faʻavae e pei o OpenBSD na litaea le Ethereal tuai mo lena mafuaaga. Faatasi ai ma le faʻataʻitaʻiga o loʻo i ai nei, o le vavae ese mai le puʻeina ma faʻafouga faifai pea e faʻaleleia ai le tulaga, ae e fautuaina i taimi uma mulimuli i faatonuga mo le saogalemu Ma, afai e te iloa se gaioiga masalomia, iloa pe faapefea poloka feso'ota'iga feso'ota'iga masalomia ma aloese mai le tatalaina o screenshots e le talitonuina e aunoa ma se iloiloga muamua.

Fa'asologa o faila, fa'apipi'i, ma fonuka fa'apitoa

E faitau ma tusia e Wireshark le pcap ma le pcapng, faʻapea foʻi ma faʻasologa mai isi tagata suʻesuʻe e pei o le snoop, Network General Sniffer, Microsoft Network Monitor, ma le tele o lisi e Wiretap i luga. E mafai ona tatalaina faila faʻapipiʻi pe afai na tuʻufaʻatasia ma faletusi mo pcapng. GZIP, LZ4 ma le ZSTDAemaise lava, GZIP ma LZ4 faʻatasi ma poloka tutoʻatasi e mafai ai ona oso vave, faʻaleleia le faʻatinoga o le GUI i puʻeina tetele.

O faʻamatalaga o le poloketi e pei o le AIX iptrace (lea e tapunia lelei ai le HUP i le daemon), lagolago mo Lucent/Ascend traces, Toshiba ISDN poʻo CoSine L2, ma faʻaalia le auala e puʻeina ai le tusitusiga i se faila (faʻataʻitaʻiga, ma telnet <equipo> | tee salida.txt poʻo le faʻaaogaina o le meafaigaluega tusilima) e faaulufale mai mulimuli ane ma text2pcap. O auala nei e ave'esea ai oe "fa'aleaganu'u" pu'eina pe a e faʻaogaina meafaigaluega e le tuʻu saʻo i luga o le pcap.

Su'ega fa'aoga ma vaega filifiliga

I le faaopoopo atu i Wireshark ma TShark, o le tufatufaina e aofia ai tele meafaigaluega e aofia ai galuega patinoA aunoa ma le kopiina o le fesoasoani i le upu verbatim, o se otootoga lenei o loʻo faʻatulagaina i vaega ina ia e iloa le mea e fai e mea taʻitasi ma mea e te mauaina:

• lapisi: "mama ma faigofie" pcap / pcapng puʻeina, filifiliga faʻafesoʻotaʻi, filiga BPF, lapoʻa lapisi, suiga i le taimi / lapopoa / faila, fatuina o pupuni mama, puʻeina faʻamatalaga ma gaioiga i le faatulagaga mafai ona faitau masiniE lapata'ia le fa'agaoioia o le JIT o le BPF ona o a'afiaga e ono tula'i mai.
• capinfosE faʻaalia le ituaiga faila, faʻapipiʻi, fesoʻotaʻiga, ma metadata; numera o pepa, lapopoa o faila, umi atoa, tapula'a ata, fa'asologa (muamua/mulimuli), fua faatatau masani (bps/Bps/pps), averesi le lapo'a o pepa, fa'ailoga, ma fa'amatalaga. E fa'ataga ai fa'asologa fa'asologa po'o fa'amatalaga au'ili'ili ma fa'asologa e mafai ona faitau i masini.
• mata'itusi: fa'ailoa le ituaiga pu'e faila mo se tasi pe sili atu fa'amaumauga ma fesoasoani ma fa'aliliuga filifiliga.
• editcapNa te filifilia / tape laina pusa, faʻapipiʻi / tipi, fetuutuunai timestaps (e aofia ai ma le faʻatonuga), aveese kopi faʻatasi ma faʻamalama faʻapipiʻi, faʻaopoopo faʻamatalaga i le faʻavaa, vaelua le gaioiga i le numera poʻo le taimi, suia pusa ma faʻapipiʻi, galue ma mealilo decryption, ma compresses galuega. O le mea faigaluega uma mo le "fa'amamaina" pu'ega.
• mergecap: tu'ufa'atasia le tele o pu'eina i le tasi, a le o le fa'amaopoopo laina po'o le fa'afefiloi o timestamp, fa'atonutonu snaplen, fa'amatala le ituaiga galuega, faiga fa'afefiloi IDB ma le fa'amalosi mulimuli.
• reordercap: toe fa'atonu se faila e ala i le timestamp e fa'atupuina ai se galuega mama ma, afai ua uma ona fa'avasega, e mafai ona aloese mai le tusiaina o le taunu'uga e fa'asaoina I/O.
• text2pcap: liliu hexdumps poʻo tusitusiga faʻatasi ma le regex e faʻamaonia le puʻeina; iloa fa'aletonu i fa'amaumauga 'ese'ese, fa'amaufa'ailoga taimi ma fa'asologa o taimi (e aofia ai le sa'o sa'o), iloa fa'apipi'i ASCII pe a talafeagai, ma e mafai ona fa'apipi'i fa'aulutala "dummy" (Ethernet, IPv4/IPv6, UDP/TCP/SCTP, EXPORTED_PDU) ma uafu, tuatusi, ma igoa faailoa mai.
• rawshark: “matamata” le faitau tusi; e mafai ai ona e setiina le faʻapipiʻiina poʻo le faʻamavaeina o faʻasalalauga, faʻamalo faʻaiʻuga igoa, seti faitau / faʻaalia filiga ma filifili le faʻasologa o galuega, aoga mo paipa ma isi meafaigaluega.
• randpktFa'atupu faila i fa'ailoga fa'asolo o ituaiga e pei o le ARP, BGP, DNS, Ethernet, IPv4/IPv6, ICMP, TCP/UDP, SCTP, Syslog, USB-Linux, ma isi, fa'ailoa mai le tala, le maualuga maualuga, ma le atigipusa. Lelei mo suʻega ma faʻataʻitaʻiga.
• mmdbresolve: Query MaxMind databases (MMDB) e faʻaalia ai le geolocation o tuatusi IPv4/IPv6, faʻamaonia se tasi pe sili atu faila faila.
• sharkd: daemon e fa'aalia se API (mode "auro") po'o le socket masani (mode "classic"); lagolagoina fa'amatalaga fa'atulagaina ma e pulea mai tagata fa'atau mo le vaeluaga o le itu-aumau ma su'esu'ega, aoga i masini ma auaunaga.

Faiga, uiga ma tapula'a

E fa'alagolago le Wireshark i le libpcap/Npcap mo le pu'eina, ma i luga o se fa'alapotopotoga o faletusi (libwireshark, libwiretap, libwsutil) e tu'u'ese'ese ai le fa'asoa, fa'asologa, ma mea fa'aoga. E mafai ai ona iloa le telefoni VoIP, toe fa'alogo leo i fa'aliliuga lagolago, pu'eina fe'avea'i USB mata'utia, ma fa'amama i luga o feso'otaiga Wi-Fi (pe a latou uia le Ethernet mata'ituina). plugins mo protocols fou tusia i le C po o le Lua. E mafai fo'i ona maua le va'aiga mamao fa'apipi'i (fa'ata'ita'iga, TZSP) mo su'esu'ega i taimi moni mai se isi masini.

E le o se IDS, e le tuuina atu foi ni mataala; o lana matafaioi e le mautonu: e asiasia, fua, ma faʻaalia. E ui lava i lea, o meafaigaluega fesoasoani e maua ai fuainumera ma galuega, ma o mea tau aʻoaʻoga e faigofie ona maua (e aofia ai polokalame faʻaleaʻoaʻoga e faʻatatau i le 2025 e aʻoaʻo ai filiga, sogisogi, faʻamaufaʻailoga OS, suʻesuʻega taimi moni, masini, fefaʻatauaʻiga faʻailoga, ma tuʻufaʻatasia ma faiga DevOps). O lenei itu faaleaoaoga e faaatoatoaina le faatinoga autu o su'esu'ega ma fa'afitauli.

Fegalegaleaiga ma le fa'anatura

O le fausiaina ma le suʻega faʻavae e aofia ai Linux (Ubuntu), Windows ma macOSO loʻo taʻua foʻi e le poloketi le fesoʻotaʻiga lautele ma isi faiga faʻapitoa e pei o Unix ma tufatufa atu e ala i pule o isi vaega. I nisi tulaga, e mana'omia e fa'asologa tuai o le OS ni lala muamua (mo se fa'ata'ita'iga, Windows XP fa'atasi ma le version 1.10 po'o muamua). E masani lava, e mafai ona e faʻapipiʻi mai fale teu oloa poʻo binaries i le tele o siosiomaga e aunoa ma ni faʻafitauli tetele.

Latou te tuʻufaʻatasia ma fesoʻotaʻiga simulators (ns, OPNET Modeler), ma mea faigaluega lona tolu (faʻataʻitaʻiga, Aircrack mo 802.11) e mafai ona faʻaogaina e maua ai le puʻeina o Wireshark e tatala e aunoa ma se faigata. E fai ma sui fa'atulafonoina ma le fa'amaoniManatua e na'o le pu'eina i luga o feso'ota'iga ma fa'aaliga e iai sau fa'atagaga fa'aalia.

Igoa, upegatafa'ilagi aloaia, ma fa'amaumauga fa'atonutonu

O le upega tafaʻilagi aloaia wireshark.orgfa'atasi ai ma la'u mai i totonu o lona/download subdirectory ma fa'amaumauga i luga ole laiga mo tagata fa'aoga ma atina'e. E iai itulau ma pulega pule (fa'ata'ita'iga, GND) ma lisi o feso'ota'iga i le fa'aputuga fa'akomepiuta, siaki pusi, ma le blog blog, aoga mo le tausisia o tala fou ma lipoti o mataupu.

Ae e te le'i amataina le pu'eina, fa'amaonia le fa'atagaga ma le gafatia o lau polokalama, filifili pe e te fa'aogaina le dumpcap/tcpdump e lafo i le tisiki ma au'ili'ili e aunoa ma ni fa'amanuiaga, ma saunia le pu'e ma fa'aali filiga e fetaui ma lau fa'amoemoe. Faatasi ai ma se metotia lelei, Wireshark faʻafaigofie le lavelave ma tuʻuina atu ia te oe faʻamatalaga saʻo. Le va'aiga e te mana'omia e su'esu'e, a'oa'o, pe su'e su'e so'o se tele.

Tusitusiga fesoʻotaʻi:

O le a le mea e fai i le 24 itula muamua pe a uma le hack: telefoni feaveaʻi, PC ma luga ole laiga

Daniel Terrasa

Fa'atonu fa'apitoa i fa'amatalaga fa'atekonolosi ma initaneti ma le sili atu ma le sefulu tausaga o le poto masani i fa'asalalauga fa'atekinolosi eseese. Sa ou galue o se faatonu ma fatuga o mataupu mo e-pisinisi, fesoʻotaʻiga, maketi i luga ole laiga ma kamupani faʻasalalauga. Na ou tusia foi i luga o le tamaoaiga, tupe ma isi vaega upega tafaʻilagi. O laʻu galuega o loʻu fiafia foi. O lenei, e ala i aʻu tusiga i Tecnobits, Ou te taumafai e suʻesuʻe uma tala fou ma avanoa fou e ofoina mai e le lalolagi o tekinolosi ia i tatou i aso uma e faʻaleleia ai o tatou olaga.