Wireshark ---- teach you how to capture packets, wireshark ---- capture packets

Wireshark ---- teach you how to capture packets, wireshark ---- capture packets
Wireshark ---- teach you how to capture packets

Wireshark is a powerful packet capture tool. When you learn the TCP/IP protocol, it is the best way to use wireshark to capture packets, first, let's look at the Protocol. Then, capture various Protocol packets and analyze each byte to correspond to the encapsulation of each layer of the Protocol. Well, I still don't want to co-write it. What is written.
Install wireshark before capturing packets.This is probably the case with the wireshark icon.


This is probably the case after opening:
There are two NICs:I used a wireless network card to access the Internet, so I chose the following:
Start packet capture:

Catch a lot, right.But what are the meanings of these packages?We use the DNS protocol as an example,We enable packet capture to access http://blog.csdn.net/
We know that when accessing a website, we first query the IP address of the domain name on the Domain Name Server.
We will see a package like this:


Right-click the package:
Follow UDP Stream tracks the entire DNS query process.
At this time, only two packages are left, one request query package and one response package.There are two IP addresses: 192.168.1.109 is the IP address of my local machine, and 202.112.14.151 is the DNS server address.We can query this information through ipconfig/all of DOS.

We open the first package,

From top to bottom: we can see the Protocol corresponding to each layer. User datasync Protocol indicates that the DNS query package uses the UDP transmission Protocol, so you can understand follow udp stream.Domain Name System (query) DNS queryClickDomain Name System (query). Check if the hexadecimal format is like this.

Let's take a look at the first package:
See it. We are querying the blog.csdn.net domain name.
Let's look at the second package:
See it. This is the second package. Our Query IP is returned.
The logic of my text is too messy.