"Grab Bag Tool" Wireshark

wireshark:http://download.csdn.net/detail/victoria_vicky/8819777

First, Wireshark advantages and disadvantages

Wireshark disadvantage: Can only view the packet, not modify the packet content, or send packets;

Wireshark VS Fiddler

Fiddler: Specifically capture HTTP, HTTPS;

Wireshark: Can get http, HTTPS, but can not decrypt HTTPS, so wireshark not decrypt HTTPS content;

Summary: Handle HTTP and HTTPS using Fiddler, others such as ftp,udp use Wireshark;

Ii. Use of Wireshark users

1, network administrator use to check network problems

2, software Testing engineer to grasp the package analysis of their own software

Three, Wireshark window introduction

which

OSI (Open System Interconnection): Open Network interconnect

OSI layer Seven Network model:

Physical Layer: Physical layer

Data Link Layer

Transport Layer: Transport Layer

Networking layer: Network layers

Session Layers: Sessions layer

Presentation Layer: Presentation layer

Application Layer: Application layer

TCP/IP layered models (TCP/IP layening model)

Application Layer	Application Layer	Dns	Ftp
Presentation Layer		HTTP	Telnet
Session Layer		Smtp	Irc
Transport Layer	Transport Layer	Tcp	Udp
Network layer	Network layer	Ip	Icmp
Data Link Layer	Network interface Layer	Arp/rarp	Other
Physical Layer

TCP Package Specific content

Four, Wireshark filtration method

1.

2.

3. Filter expression rules

Protocol filtering: TCP, UDP, etc.

IP filtering: ip.src==192.168.0.196 and ip.dst==14.17.32.236;

Port filtering: tcp.port==80;tcp.srcport==80;

HTTP Filtering mode: http.request.method== "GET";

logical operators: and/or;

五、三次 Handshake Protocol

First time: The client sends a TCP, flag bit seq=x,ack=0, which represents the client request to establish a connection;

The client requests to establish a connection, sending its own serial number 0to the server side;

The second time: The server sends back the confirmation package,seq=y,ack=x+1;

The server side received the request from the client, sent back the confirmation ordinal 0+1, and returned to their own serial number 0;

The third time: The client sends the confirmation packet again,seq=x+1,ack=y+1;

The client receives a confirmation number from the server side and sends back the transport official sequence number 1to the server and sends back

Own serial number 0+1;

Vi. how to get the relevant data report information

"Grab Bag Tool" Wireshark