目 录 Table of Contents
1 概述.............................................................................................................................................4
2 软件安装......................................................................................................................................4
2.1 安装 WinPcap 提示冲突且不可删除........................................................................................4
2.2 安装 Wireshark 后网卡选项中找不到网卡...............................................................................5
2.3 Windows 7 下提示 NPF 驱动未运行，找不到网卡..................................................................5
3 数据采集......................................................................................................................................6
3.1 使用 Wireshark 采集数据.........................................................................................................6
3.1.1 Wireshark 抓包选项................................................................................................................7
3.1.2 捕捉滤波器............................................................................................................................10
3.2 使用其它软件采集数据..........................................................................................................11
3.2.1 Windows 7 下 Wireshark 抓包找不到 Huawei E398 虚拟网卡，利用 MS Network
Monitor 采集数据...........................................................................................................................11
4 软件设置....................................................................................................................................12
4.1 Wireshark 基本界面...............................................................................................................12
4.2 参数设置................................................................................................................................13
4.2.1 如何配置 Packet list pane（包列表显示区）显示项.........................................................13
4.2.2 IP 协议配置...........................................................................................................................15
4.2.3 TCP 协议配置.......................................................................................................................15
4.2.4 ESP 协议配置........................................................................................................................16
5 数据处理....................................................................................................................................16
5.1 常规技能................................................................................................................................16
5.1.1 时间设置................................................................................................................................16
5.1.2 如何快速找到某个包...........................................................................................................17
5.1.3 指定协议解析........................................................................................................................18
5.1.4 如何自动重组分片包...........................................................................................................19
5.2 文件处理................................................................................................................................19
5.2.1 仅保存需要的数据...............................................................................................................19
5.2.2 多文件合并............................................................................................................................21
5.2.3 转换文件格式输出...............................................................................................................22
5.3 Wireshark 自带的命令行工具................................................................................................23
5.3.1 如何使用 Wireshark 命令行工具.........................................................................................23
5.3.2 利用 editcap 分割文件..........................................................................................................24
6 数据分析....................................................................................................................................25
6.1 Wireshark 数据分析基本知识................................................................................................25
6.1.1 Wireshark 基本标识..............................................................................................................25
6.1.2 抓包统计 Summary...............................................................................................................26
6.1.3 流量统计 IO Graphs.............................................................................................................26
6.1.4 汇总所有日志的专家信息 Expert Info Composite.............................................................30
6.1.5 交互流图 Flow Graph...........................................................................................................31
6.2 TCP 基本参数分析................................................................................................................32
6.2.1 TCP 接收窗口.......................................................................................................................32
6.2.2 TCP 发送窗口.......................................................................................................................33
6.2.3 其它 TCP 基本参数...............................................................................................................34
6.2.4 RTT 环回时延.......................................................................................................................35
第页,共页
