Mokhoa oa ho sebelisa Wireshark ho bona mathata a marang-rang

Haeba o sebetsa ho marang-rang, ts'ireletso, kapa nts'etsopele mme o batla ho utloisisa se etsahalang likhoeleng tsa hau le Wi-Fi, o sebetsa le Wireshark Ke ntho ea bohlokoa. Sena open source package analyzer ka lilemo tse mashome tsa ho iphetola ha lintho tse lumellang ho ts'oara, ho arola le ho ithuta sephethephethe boemong ba pakete ka mokhoa o nepahetseng oa ho buoa.

Sehloohong sena re e sekaseka ka botebo: ho tloha ho laesense ea eona le tšehetso ho ea ho liphutheloana tsa eona ho GNU/Linux, ho kenyeletsoa lisebelisoa tsa li-console, liforomo tse tšehetsoeng, litlhoko tsa ho bokella, tumello ea ho hapa le kakaretso e felletseng ea nalane le ts'ebetso.

Wireshark ke eng mme e sebelisetsoa eng kajeno?

Ha e le hantle, Wireshark ke protocol analyzer le sesebelisoa sa ho hapa sephethephethe e u lumellang hore u behe sebopeho ka mokhoa o hlephileng kapa oa ho beha leihlo (haeba sistimi e e tšehetsa) 'me u shebe liforeimi tse neng li ke ke tsa romelloa ho Mac ea hau, sekaseka lipuisano, u hlophise phallo bocha, lipakete tsa mebala ho latela melao, 'me u sebelise li-filters tse hlakileng haholo. Ho feta moo, e kenyelletsa TShark (terminal version) le sete ea lisebelisoa bakeng sa mesebetsi e kang ho hlophisa bocha, ho arola, ho kopanya, le ho fetola linepe tsa skrini.

Leha ts'ebeliso ea eona e hopotsa tcpdump, e fana ka sebopeho sa sejoale-joale sa graphical se thehiloeng ho Qt le ho tlhotla, ho hlopha, le karohano e tebileng bakeng sa likete tsa protocol. Haeba u le sesebelisoa, hopola hore boitšoaro bo hlephileng ha bo tiise hore u tla bona sephethephethe kaofela: bakeng sa maemo a feletseng u tla hloka li-port mirroring kapa li-taps tsa marang-rang, tseo litokomane tsa bona li buang ka tsona e le mekhoa e metle.

Laesense, motheo le mohlala oa ntlafatso

Wireshark e ajoa ka tlas'a GNU GPL v2 le libakeng tse ngata, joalo ka "GPL v2 kapa hamorao". Lisebelisoa tse ling ho khoutu ea mohloli li na le laesense ka tlas'a lilaesense tse fapaneng empa tse lumellanang, joalo ka sesebelisoa sa pidl se nang le GPLv3+, se sa ameng sephetho sa binary sa mohlahlobi. Ha ho na waranti e hlakileng kapa e boletsoeng; e sebelise ka kotsi ea hau, joalo ka ha ho tloaelehile ka software ea mahala.

La Wireshark Foundation E hokahanya ntlafatso le kabo. E itšetlehile ka menehelo e tsoang ho batho ka bomong le mekhatlo eo mosebetsi oa eona o thehiloeng ho Wireshark. Morero o ithorisa ka bangoli ba likete ba ngolisitsoeng le batho ba nalane ba kang Gerald Combs, Gilbert Ramirez, le Guy Harris har'a batšehetsi ba eona ba hlahelletseng.

Wireshark e sebetsa ho Linux, Windows, macOS, le lits'ebetso tse ling tse kang Unix (BSD, Solaris, joalo-joalo). Liphutheloana tsa molao li lokolloa bakeng sa Windows le macOS, 'me ho GNU/Linux hangata e kenyelelitsoe e le sephutheloana se tloaelehileng kapa sa tlatsetso liphaellong tse kang Debian, Ubuntu, Fedora, CentOS, RHEL, Arch, Gentoo, openSUSE, FreeBSD, DragonFly BSD, NetBSD, le OpenBSD. E fumaneha hape le lits'ebetsong tsa mokha oa boraro joalo ka Homebrew, MacPorts, pkgsrc kapa OpenCSW.

Ho bokella ho tloha khoutu, o tla hloka Python 3; AsciiDoctor bakeng sa litokomane; le lisebelisoa tse kang Perl le GNU flex (lex ea khale e ke ke ea sebetsa). Tlhophiso e sebelisang CMake e u lumella ho nolofalletsa kapa ho tima ts'ehetso e khethehileng, mohlala, lilaebrari tsa khatello ka -DENABLE_ZLIB=TLOHA, -DENABLE_LZ4=TLOHA kapa -DENABLE_ZSTD=TLOHA, kapa tšehetso ea libsmi ka -DENABLE_SMI=OFF haeba u sa rate ho kenya MIBs.

Liphutheloana le lilaebrari ho litsamaiso tse thehiloeng ho Debian

Sebakeng sa Debian/Ubuntu le tikolohong e nkiloeng, Wireshark ecosystem e arotsoe ka liphutheloana tse ngataKa tlase ke karohano e nang le likarolo, boholo bo hakanyetsoang, le tse itšetlehileng ka tsona. Liphutheloana tsena li u lumella ho khetha ho tloha ho GUI e felletseng ho ea lilaeboraring le lisebelisoa tsa nts'etsopele bakeng sa ho kopanya likhechana ho likopo tsa hau.

shark ea terata

Sesebelisoa sa Graphical bakeng sa ho hapa le ho sekaseka sephethephethe ka sebopeho sa Qt. Khakanyo ea boholo: 10.59 MB. Setsi: sudo apt install wireshark

Har'a likhetho tsa eona tsa ho qala u tla fumana liparamente ho khetha sebopeho (-i), ho nka lifilimi (-f), moeli oa snapshot, mokhoa oa ho beha leihlo, manane a mefuta ea lihokela, li-filters tse bonts'ang (-Y), "Decode As" le likhetho, hammoho le liforomo tsa tlhahiso ea faele le ho hapa maikutlo. Kopo e boetse e lumella tlhophiso profiling le lipalo-palo lintlha tse tsoetseng pele ho tloha segokanyimmediamentsi sa sebolokigolo.

tshark

Phetolelo ea Console bakeng sa ho hapa le ho sekaseka line-taelo. Khakanyo ea boholo: 429 KB. Setsi: sudo apt install tshark

E u lumella ho khetha li-interfaces, ho sebelisa li-filters tsa ho hapa le ho bonts'a, ho hlalosa maemo a ho emisa (nako, boholo, palo ea lipakete), sebelisa li-buffers tse chitja, lintlha tsa khatiso, li-dumps tsa hex le tsa JSON, le ho romela lintho le linotlolo tsa TLS. E ka boela ea kenya mebala e hlahisoang ka har'a terminal e lumellanang. lokisa ho rema lifate ka libaka le maemo a lintlha. Ho eletsoa tlhokomeliso haeba u nolofalletsa BPF JIT boemong ba kernel, kaha e ka ba le liphello tsa ts'ireletso.

wireshark-e tloaelehileng

Lifaele tse tloaelehileng bakeng sa wireshark le tshark (mohlala, didikishinari, litlhophiso, le lisebelisoa tsa mohala). Khakanyo ea boholo: 1.62 MB. Setsi: sudo apt install wireshark-common

Sephutheloana sena se kenyelletsa lisebelisoa tse kang capinfos (ts'oara lintlha tsa faele: mofuta, encapsulation, nako, litefiso, boholo, li-hashes le maikutlo), captype (hlalosa mefuta ea lifaele), thotobolo (sesebediswa sa ho hapa se bobebe se sebedisang pcapng/pcap se nang le autostop le circular buffers), editcap (edita/arola/fetola tse hapiloeng, lokisa litempe tsa nako, tlosa tse kopitsoang, eketsa maikutlo kapa liphiri), mergecap (kopanya kapa kopanya litšoantšo tse ngata), mmdbresolve (rarolla geolocation ea IP ka li-database tsa MMDB), randpkt (jenereithara ea li-protocol synthetic packet generator), rawshark (karohano e tala e nang le tlhahiso ea tšimo), reordercap (hlopha bocha ka setempe sa nako), sharkd (daemon e nang le API ho sebetsana le ho hapa) le mongolo2pcap (fetola li-hexdumps kapa mongolo o hlophisitsoeng hore e be litšoantšo tse nepahetseng).

libwireshark18 le libwireshark-data

Laeborari ea ho arola lipakete tse bohareng. E fana ka li-protocol analyzers tse sebelisoang ke Wireshark/TShark. Kakaretso ea boholo ba laebrari: 126.13 MB. Setsi: sudo apt install libwireshark18 y sudo apt install libwireshark-data

E kenyelletsa ts'ehetso ea palo e kholo ea liprothokholo le likhetho tse kang ho nolofalletsa kapa ho tima li-dissections tse itseng, li-heuristics, le "Decode As" ho tsoa ho sehokelo kapa mola oa taelo; ka lebaka la sena, o ka ikamahanya le maemo karohano ea sephethephethe sa 'nete ea tikoloho ea hau.

libwiretap15 le libwiretap-dev

Wiretap ke laebrari ea ho bala le ho ngola liforomo tse ngata tsa ho hapa lifaele. Matla a eona ke mefuta e fapaneng ea lifomate tseo e li tšehetsang; mefokolo ea eona ke: Ha e sefa kapa ho kenya letsoho ka kotloloho.. Setsi: sudo apt install libwiretap15 y sudo apt install libwiretap-dev

Mofuta oa -dev o fana ka laeborari e tsitsitseng le lihlooho tsa C ho kopanya ts'ebetso ea ho bala / ho ngola lisebelisoa tsa hau. Sena se o nolofalletsa ho hlahisa lisebelisoa tse laolang data. pcap, pcapng le lijana tse ling e le karolo ea lipeipi tsa rona.

libwsutil16 le libwsutil-dev

Sehlopha sa lits'ebeletso tse arolelanoang ke Wireshark le lilaebrari tse amanang le tsona: mesebetsi e thusang bakeng sa ho qhekella ha likhoele, ho boloka, ho kenyelletsa, joalo-joalo. sudo apt install libwsutil16 y sudo apt install libwsutil-dev

Sephutheloana sa -dev se kenyelletsa lihlooho le laeborari e tsitsitseng e le hore lits'ebetso tsa kantle li ka hokahanya lits'ebeletso tse tloaelehileng ntle le ho nchafatsa mabili. Ke motheo oa mesebetsi e mengata e arolelanoang ba sebelisang Wireshark le TShark.

wireshark-dev

Lisebelisoa le lifaele tsa ho theha "dissectors" tse ncha. E fana ka mangolo a kang idl2wrs, hammoho le lintho tse itšetlehileng ka ho bokella le ho hlahloba. Khakanyo ea boholo: 621 KB. Setsi: sudo apt install wireshark-dev

E kenyelletsa lisebelisoa tse kang asn2deb (e hlahisa liphutheloana tsa Debian bakeng sa tlhahlobo ea BER ho tsoa ho ASN.1) le idl2deb (liphutheloana tsa CORBA). 'Me, ka holim'a tsohle, idl2wrsSesebelisoa sena se fetola CORBA IDL hore e be skeleton ea plugin ea C bakeng sa ho arola sephethephethe sa GIOP/IIOP. Ts'ebetso ena e ipapisitse le lingoloa tsa Python (wireshark_be.py le wireshark_gen.py) mme e ts'ehetsa karohano ea heuristic ka boiketsetso. Sesebelisoa se batla li-module tsa sona ho PYTHONPATH/liphutheloana tsa sebaka kapa bukeng ea hajoale, mme e amohela ho fetisoa ha faele ho hlahisa khoutu.

wireshark-doc

Litokomane tsa basebelisi, tataiso ea nts'etsopele le referense ea Lua. Khakanyo ea boholo: 13.40 MB. Setsi: sudo apt install wireshark-doc

E khothaletsoa haeba u batla ho teba haholoanyane extensions, scripting le APIsLitokomane tse fumanehang webosaeteng ea semmuso li nchafatsoa ka mofuta o mong le o mong o tsitsitseng.

Litumello tsa ho ts'oara le ts'ireletso

Litsamaisong tse ngata, ho hapa ka kotloloho ho hloka litokelo tse phahameng. Ka lebaka lena, Wireshark le TShark baemeli ba ts'oara litšebeletso tsa mokha oa boraro. thotoboloBinary e etselitsoeng ho sebetsa ka litokelo (set-UID kapa bokhoni) ho fokotsa sebaka sa tlhaselo. Ho tsamaisa GUI eohle joalo ka motso ha se tloaelo e ntle; ho molemo ho hapa ka dumpcap kapa tcpdump le ho sekaseka ntle le litokelo ho fokotsa likotsi.

Nalane ea morero e kenyelletsa liketsahalo tsa ts'ireletso ho li-dissectors ho theosa le lilemo, 'me li-platform tse ling tse kang OpenBSD li ile tsa tlohela mohlala oa khale oa Ethereal ka lebaka leo. Ka mohlala oa hona joale, ho itšehla thajana ho tloha ho ts'oaroa le ho ntlafatsoa kamehla ho ntlafatsa boemo, empa kamehla ho eletsoa ho latela lintlha tsa polokeho 'Me, haeba u lemoha ketso e belaetsang, tseba hore na joang thibela likhokahano tsa marang-rang tse belaetsang 'me u qobe ho bula li-screenshots tse sa tšepahaleng ntle le tlhahlobo ea pele.

Liforomo tsa faele, compression, le lifonti tse khethehileng

Wireshark e bala le ho ngola pcap le pcapng, hammoho le lifomate tse tsoang ho li-analyzer tse ling tse kang snoop, Network General Sniffer, Microsoft Network Monitor, le tse ngata tse thathamisitsoeng ke Wiretap ka holimo. E ka bula lifaele tse hatelitsoeng haeba li ne li hlophisitsoe le lilaebrari tsa pcapng. GZIP, LZ4 le ZSTDHaholo-holo, GZIP le LZ4 tse nang le li-blocks tse ikemetseng li lumella ho qhoma ka potlako, ho ntlafatsa ts'ebetso ea GUI ho hapa ho hoholo.

Litokomane tsa morero li na le likarolo tse kang AIX iptrace (moo HUP ho daemon e koalang ka mokhoa o hloekileng), tšehetso ea Lucent / Ascend traces, Toshiba ISDN kapa CoSine L2, 'me e bontša mokhoa oa ho hapa tlhahiso ea mongolo ho faele (mohlala, ka telnet <equipo> | tee salida.txt kapa ho sebelisa sesebelisoa sengoloa) ho e tlisa hamorao ka text2pcap. Litsela tsena lia u ntša "tloaelehileng" ho hapa ha o sebelisa lisebelisoa tse sa faneng ka ho toba holim'a pcap.

Lisebelisoa tsa Suite le mekhahlelo ea khetho

Ntle le Wireshark le TShark, kabo e kenyelletsa lisebelisoa tse 'maloa tse koahelang mesebetsi e khethehileng haholoNtle le ho kopitsa mongolo oa thuso lentsoeng le le leng, kakaretso ke ena e hlophisitsoeng ho latela mekhahlelo e le hore u tsebe seo e 'ngoe le e 'ngoe e se etsang le hore na u tla fumana likhetho life:

• thotobolo: "e hloekileng le e bonolo" pcap / pcapng e ts'oara, khetho ea sebopeho, li-filters tsa BPF, boholo ba buffer, ho potoloha ka nako / boholo / lifaele, ho thehoa ha li-buffers, ho hapa maikutlo le tlhahiso ka mokhoa e ka baloang ka mochiniE hlokomelisa khahlano le ho kenya tšebetsong JIT ea BPF ka lebaka la likotsi tse ka bang teng.
• capinfosE bonts'a mofuta oa faele, encapsulation, interfaces, le metadata; palo ea lipakete, boholo ba faele, bolelele ba kakaretso, moeli oa setšoantšo, tatellano ea liketsahalo (ea pele / ea ho qetela), litekanyetso tse tloaelehileng (bps / Bps / pps), boholo ba pakete ea karolelano, li-hashes le litlhaloso. E lumella tlhahiso ea tabular kapa e qaqileng le lifomate tse baloang ka mochini.
• captype: e khetholla mofuta oa faele ea ho hapa bakeng sa keno e le 'ngoe kapa ho feta ka thuso le likhetho tsa mofuta.
• editcapE khetha / e hlakola mekhahlelo ea liphutheloana, snaps / chops, fetola timestamps (ho kenyeletsoa taelo e thata), e tlosa likopi tse nang le lifensetere tse lokisehang, e eketsa litlhaloso ka foreimi, e arola lihlahisoa ka palo kapa nako, e fetola setshelo le encapsulation, e sebetsa ka liphiri tsa decryption, le compresses output. Ke sesebelisoa sa merero eohle sa "ho hloekisa" ho hapa.
• mergecap: e kopanya litšoantšo tse ngata ho e le 'ngoe, ebang ke ka ho kopanya linear kapa timestamp-based mixing, controls snaplen, e hlalosa mofuta oa tlhahiso, mokhoa oa ho kopanya oa IDB le compression ea ho qetela.
• reordercap: E hlophisa faele ka setempe sa nako e hlahisang tlhahiso e hloekileng, 'me haeba e se e hlophisitsoe, e ka qoba ho ngola sephetho ho boloka I/O.
• mongolo2pcap: e fetolela li-hexdumps kapa mongolo o nang le regex hore o tšoaroe hantle; e lemoha li-offsets ka har'a li-database tse fapaneng, litempe tsa linako tse nang le liforomo tsa strptime (ho kenyeletsoa ho nepahala ha karoloana), e lemoha ASCII e khomaretsoeng haeba e sebetsa, 'me e ka lokisetsa lihlooho tsa "dummy" (Ethernet, IPv4/IPv6, UDP/TCP/SCTP, EXPORTED_PDU) ka likou, liaterese, le lileibole bontshitse.
• rawshark: "raw" sebali se sekametseng tšimong; e o lumella ho beha protocol ea encapsulation kapa dissection, ho tima liqeto tsa mabitso, ho beha li-filters tsa ho bala / ho bonts'a le ho etsa qeto ea sebopeho sa tlhahiso ea tšimo, e sebetsang bakeng sa liphaephe tse nang le lisebelisoa tse ling.
• randpktE hlahisa lifaele ka lipakete tse sa reroang tsa mefuta e joalo ka ARP, BGP, DNS, Ethernet, IPv4/IPv6, ICMP, TCP/UDP, SCTP, Syslog, USB-Linux, joalo-joalo, e totobatsang ak'haonte, boholo ba boholo, le setshelo. E loketseng bakeng sa liteko le li-demos.
• mmdbresolve: Potso ea MaxMind databases (MMDB) ho bonts'a geolocation ea liaterese tsa IPv4/IPv6, ho hlakisa faele e le 'ngoe kapa tse ngata tsa database.
• sharkd: daemon e pepesang API (mokhoa oa "khauta") kapa sokete ea khale (mokhoa oa "classic"); e ts'ehetsa liprofaele tsa tlhophiso mme e laoloa ho tsoa ho bareki bakeng sa dissection ea lehlakore la seva le lipatlisiso, tse sebetsang ho othomathiki le lits'ebeletso.

Mehaho, litšobotsi le mefokolo

Wireshark e itšetlehile ka libpcap/Npcap bakeng sa ho hapa, le ho ecosystem ea lilaeborari (libwireshark, libwiretap, libwsutil) tse arolang karohano, lifomate le lits'ebeletso. E lumella ho lemoha mehala ea VoIP, ho bapala ka molumo ho li-encodings tse tšehetsoeng, ho ts'oaroa ha sephethe-phethe sa USB, le ho sefa marang-rang a Wi-Fi (haeba a tšela Ethernet e shebisitsoeng). plugins bakeng sa liprothokholo tse ncha e ngotsoeng ka C kapa Lua. E ka boela ea amohela sephethephethe se hole se kentsoeng (mohlala, TZSP) bakeng sa tlhahlobo ea nako ea nnete ho tsoa mochining o mong.

Ha se IDS, ebile ha e fane ka litemoso; karolo ea eona ha e sebetse feela: e hlahloba, e lekanya, 'me e bontša. Leha ho le joalo, lisebelisoa tse thusang li fana ka lipalo-palo le phallo ea mosebetsi, 'me lisebelisoa tsa koetliso li fumaneha habonolo (ho kenyeletsoa le lits'ebetso tsa thuto tse lebisitsoeng ho 2025 tse rutang li-filters, ho fofonela, ho hatisa menoana ea mantlha ea OS, tlhahlobo ea nako ea nnete, automation, sephethephethe se patiloeng, le ho hokahana le mekhoa ea DevOps). Karolo ena ea thuto e tlatsana le ts'ebetso ea mantlha ea ho hlahloba le ho rarolla mathata.

Ho lumellana le tikoloho

Li-platform tsa kaho le liteko li kenyelletsa Linux (Ubuntu), Windows le macOSMorero o boetse o bua ka tšebelisano e pharaletseng le litsamaiso tse ling tse kang Unix le kabo ka batsamaisi ba mokha oa boraro. Maemong a mang, mefuta ea khale ea OS e hloka makala a fetileng (mohlala, Windows XP e nang le mofuta oa 1.10 kapa pejana). Ka kakaretso, o ka kenya ho tsoa ho polokelo ea semmuso kapa li-binaries libakeng tse ngata ntle le mathata a maholo.

Li kopanya le li-simulators tsa marang-rang (ns, OPNET Modeler), le lisebelisoa tsa motho oa boraro (mohlala, Aircrack bakeng sa 802.11) li ka sebelisoa ho hlahisa litšoantšo tseo Wireshark e li bulang ntle le bothata. Sebakeng sa molao o tiileng le melao ea boitšoaroHopola ho nka feela marang-rang le maemong ao u nang le tumello e hlakileng ho ona.

Lebitso, liwebsaete tsa molao, le boitsebiso ba taolo

El sitio web oficial es wireshark.orgka lintho tse jarollotsoeng ka har'a subdirectory ea eona ea / download le litokomane tsa inthaneteng bakeng sa basebelisi le ba ntlafatsang. Ho na le maqephe a nang le taolo ya bolaodi (mohlala, GND) le manane a likhokahano tsa polokelo ea khoutu, tracker ea bug, le blog ea projeke, e bohlokoa bakeng sa ho boloka litaba le litaba tsa tlaleho.

Pele o qala ho hapa, netefatsa litumello le bokhoni ba sistimi ea hau, etsa qeto ea hore na u tla sebelisa dumpcap/tcpdump ho lahlela ho disk le ho sekaseka ntle le litokelo, 'me u lokisetse ho hapa le ho bonts'a li-filters tse tsamaellanang le sepheo sa hau. Ka mokhoa o motle, Wireshark e nolofatsa mokhoa ona mme e u fa leseli le nepahetseng. Ponahalo eo u e hlokang ho hlahloba, ho ithuta, kapa ho hlahloba marang-rang a boholo bofe kapa bofe.

Sengoloa se amanang:

Seo u lokelang ho se etsa lihora tse 24 tsa pele ka mor'a ho qhekella: li-account tsa mobile, PC le inthaneteng

Daniel Terrasa

Mohlophisi ea ikhethileng litabeng tsa theknoloji le marang-rang ea nang le boiphihlelo bo fetang lilemo tse leshome mecheng ea litaba tse fapaneng tsa dijithale. Ke sebelitse ke le mohlophisi le moetsi oa dikahare bakeng sa khoebo ea e-commerce, puisano, papatso ea marang-rang le lik'hamphani tsa papatso. Ke ngotse hape ka liwebsaete tsa moruo, tsa lichelete le tsa makala a mang. Mosebetsi oa ka le ona ke takatso ea ka. Joale, ka lingoliloeng tsa ka ho Tecnobits, Ke leka ho hlahloba litaba tsohle le menyetla e mecha eo lefatše la theknoloji le re fang eona letsatsi le leng le le leng ho ntlafatsa bophelo ba rona.