Wireshark 基础 | 简介篇

关于

「 Wireshark 」简单的说是一个开源免费的网络数据包分析工具。

特性

「 Wireshark 」has a rich feature set which includes the following:

Deep inspection of hundreds of protocols, with more being added all the time
Live capture and offline analysis
Standard three-pane packet browser
Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many others
Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
The most powerful display filters in the industry
Rich VoIP analysis
Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
Capture files compressed with gzip can be decompressed on the fly
Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM,Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
Coloring rules can be applied to the packet list for quick, intuitive analysis
Output can be exported to XML, PostScript®, CSV, or plain text

资源

官网

https://www.wireshark.org/

使用手册

在线浏览版本
单页版 https://www.wireshark.org/docs/wsug_html/
分页版 https://www.wireshark.org/docs/wsug_html_chunked/

ZIP版本
单页版 https://www.wireshark.org/download/docs/wsug_html.zip
分页版 https://www.wireshark.org/download/docs/wsug_html_chunked.zip

PDF版本
https://www.wireshark.org/download/docs/user-guide.pdf

CHM版本
https://www.wireshark.org/download/docs/user-guide.chm

命令行手册

https://www.wireshark.org/docs/man-pages/
主要包括各类命令行工具使用手册，包括 wireshark 、wireshark 捕获和显示过滤器、tshark、dumpcap、capinfos、rawshark、editcap、mergecap、text2pcap、reordercap 等。

显示过滤器参考

https://www.wireshark.org/docs/dfref/
N多协议及其字段介绍，可以深入想要看到的确切数据包信息。

学习书籍

一般常见推荐的中文书籍，包括以下几本：
Wireshark网络分析实战第2版
https://item.jd.com/12471027.html

Wireshark数据包分析实战第3版
https://item.jd.com/12457473.html
http://product.dangdang.com/25580341.html

Wireshark网络分析就这么简单
https://item.jd.com/11574376.html
http://product.dangdang.com/23597162.html

Wireshark网络分析的艺术
https://item.jd.com/11863992.html
http://product.dangdang.com/23895500.html

英文好的同学建议还是看官方使用手册，同时也推荐 Laura Chappell 的几本书，非常经典。包括：《Wireshark Workbook 1》、《Wireshark 101:Essential Skills for Network Analysis》、《Troubleshooting With Wireshark》。

常见问题

https://www.wireshark.org/faq.html

Wiki

https://gitlab.com/wireshark/wireshark/-/wikis/home

Q&A

https://ask.wireshark.org/questions/

ISSUES

https://gitlab.com/wireshark/wireshark/-/issues

版本说明

https://www.wireshark.org/docs/relnotes/

感谢阅读，更多技术文章可关注个人公众号：Echo Reply ，谢谢。