Simple use of Wireshark

1. Concept: Wireshark is a network packet analysis tool. 2. role:

1) Capture the Network Package in real time on the interface and display the detailed protocol information of the package in detail. Wireshark can capture packets of various network interface types, even Wireless LAN interfaces.

2) Enable packages captured by multiple network analysis software and support Decoding of multiple protocols. We can use it to detect network security risks, solve network problems, and learn the implementation of network protocols and test protocols.

3. features:

It does not process network transactions. It is just a "measurement" (Monitoring) network.

It does not send network packets or other interactive tasks.

4. installation:

[Root @ attack ~] # Yum install wireshark -*

[Root @ attack ~] # Wireshark

Figure 1. wireshark startup Interface

5. Listen to ARP protocol and analyze data packets

 

Figure 1. Select "Filter"

Figure 2. Select "Expression"

Figure 3. Select "ARP" protocol | "OK"

Figure 4. Enter the filter rule name | "OK"

Figure 5 selected icons

Figure 6. Select "Start" for the "eth1" Interface"

Figure 7 capture ARP packets

Note: Number of captured data in the first column

The time when data is captured in the second column, which is counted as 0.000 seconds from the start.

The third column is the source address.

The fourth column is the destination address.

The Fifth Column is the protocol name.

The sixth column is the data packet information.

1 2 3 4 5 6 Next Page