在Wireshark較新版本中新增了遠端抓取封包功能，至於遠端抓取封包的好處自然不用說了，可以實現跨地域、彌補缺乏技術支援等等。
本文的主要目的是Demo，如何使用Wireshark進行遠端抓取封包，以及抓取封包中使用到部分技術原理說明。
需要說明的是，WIRESHARK 之所以能夠遠端抓取封包，是因為在安裝WinPcap時，已經Default安裝了一個名為rpcapd的遠端抓取封包程式，位置在\Program Files\WinPcap>。
在本地和遠程機器都安裝完畢WS後，就可以開始遠端抓取封包了。
本例中，2台測試機IP分別是：192.168.10.2（local）和192.168.10.5（remote）。
- 啟動遠端設備rpcapd
在遠端機器中，執行C:\Program Files\WinPcap>rpcapd.exe -n，如下圖
提示service已執行。其中，參數-n的意思是不驗證權限既可連接，更多rpcapd資訊請參照文後所附。
- 連接遠端抓取封包程式
啟動local WIRESHARK，在Capture選項欄選擇Remote，跳出新窗口，要求輸入IP地址、端口及驗證訊息。
由於遠端機器無驗證要求，即匿名可連接，直接輸入IP 192.168.10.3，Port使用2002
- 選擇遠端抓取封包網卡
成功連接後，Interface處會顯示遠端IP地址信息。
由於當前機器內通常會有多個網卡，這裡需要選擇正確的capture網卡。
- 抓取封包
以上設置完成後，就可以抓取封包了。
心細的你，可能發現了一些可選設置的地方，即Remote Settings。如果沒有特殊要求或想追求性能的話，建議不要修改其中選擇。
接下來，“Start”即可。
另外，從WIRESHARK Title中亦可看出，當前正在遠端抓取封包。
附：rpcapd參數
USAGE:
rpcapd [-b] [-p ] [-6] [-l ] [-a ]
[-n] [-v] [-d] [ -s ] [-f ]
-b
: the address to bind to (either numeric or literal).
Default: it binds to all local IPv4 addresses
-p : the port to bind to. Default: it binds to port 2002
-4: use only IPv4 (default both IPv4 and IPv6 waiting sockets are used)
-l : a file that keeps the list of the hosts which are allowed
to connect to this server ( if more than one, list them one per line).
We suggest to use literal names (instead of numeric ones) in order to
avoid problems with different address families
-n: permit NULL authentication (usually used with '-l')
-a : run in active mode when connecting to 'host' on port 'port'
In case 'port' is omitted, the default port (2003) is used
-v: run in active mode only (default: if ' -a' is specified, it accepts
passive connections as well
-d: run in daemon mode (UNIX only) or as a service (Win32 only)
Warning (Win32): this switch is provided automatically when the service
is started from the control panel
-s : save the current configuration to file
-f : load the current configuration from file; all the switches
specified from the command line are ignored
-h: print this help screen
rpcapd [-b] [-p ] [-6] [-l ] [-a ]
[-n] [-v] [-d] [ -s ] [-f ]
-b
: the address to bind to (either numeric or literal).
Default: it binds to all local IPv4 addresses
-p : the port to bind to. Default: it binds to port 2002
-4: use only IPv4 (default both IPv4 and IPv6 waiting sockets are used)
-l : a file that keeps the list of the hosts which are allowed
to connect to this server ( if more than one, list them one per line).
We suggest to use literal names (instead of numeric ones) in order to
avoid problems with different address families
-n: permit NULL authentication (usually used with '-l')
-a : run in active mode when connecting to 'host' on port 'port'
In case 'port' is omitted, the default port (2003) is used
-v: run in active mode only (default: if ' -a' is specified, it accepts
passive connections as well
-d: run in daemon mode (UNIX only) or as a service (Win32 only)
Warning (Win32): this switch is provided automatically when the service
is started from the control panel
-s : save the current configuration to file
-f : load the current configuration from file; all the switches
specified from the command line are ignored
-h: print this help screen
沒有留言:
張貼留言