Notes
1.0.0
gitbook1.0.0
1.0.0
gitbook1.0.0
  • Introduction
  • Commands
    • cd
    • df
    • du
    • fc-cahe
    • ifconfig
    • ip
    • ls
    • lsb_release
    • mkdir
    • mksquashfs
    • mount
    • ping
    • pwd
    • rm
    • sar
    • sudo
  • Linux C
    • Preprocessor
    • Keywords
    • Kernel
      • Ftrace
      • Watchdog
  • Python
    • general
      • Decorator
      • Generator
      • Iterator
      • Lambda
    • Download
    • NIC
  • Network
    • Protocol
      • Link layer
      • IP
      • ARP
      • ICMP
    • Proxy
      • Cntlm
      • Proxychains4
      • ShadowSocks
    • Tools
      • iperf
      • tc
      • Wireshark
    • Apps
      • samba
      • tftp
  • Software
    • Atom
    • Chrome
    • Docker
    • Git
    • Gitbook
    • Hexo
    • Nodejs
    • Teraterm
    • Tex
    • Tmux
    • VIM
    • VSCode
  • Database
    • MongoDB
  • Web
    • CSS
    • LNMP
  • Tools
    • common
    • programming
  • Ubuntu
    • Add user
    • AWS EC2
    • FAQ
    • Installer
    • Shell
    • Shell scripts
    • Themes
    • VPS
  • Windows
    • PowerShell
    • CMD
    • FAQ
  • Aphorisms
  • Book List
  • Favorites
  • Appendix
    • ASCII
    • GSM
Powered by GitBook
On this page
  • 常用过滤规则
  • 找不到接口问题处理
  • reassemble IP packet
  • 设置接口的捕获过滤器

Was this helpful?

  1. Network
  2. Tools

Wireshark

常用过滤规则

ip.addr == 192.168.1.1
http && ip.addr == 10.0.0.1
tcp.port == 8080
tcp.flags
udp
ftp
ntp
dns
bootp
igmp
arp
ppp || pppoe
icmp || icmpv6

找不到接口问题处理

以管理员身份运行CMD

sc query npf # check npf status
net start npf # start npf
sc query npf # check npf status

reassemble IP packet

wireshark 自动重组IP的分片报文，如果想要查看单独的分片信息，可以在Preferences的Protocols分组中选中IPv4,取消勾选"Reassemble fragmented Ipv4 datagrams"

设置接口的捕获过滤器

针对指定接口，在抓包之前可以通过捕获过滤器捕获指定的数据包。设置路径为：

菜单栏->Capture->Options...

进入对话框，选择指定Interface，在下面输入滤波器，比如设置“port 137”仅仅捕获NBNS数据包

PrevioustcNextApps

Last updated 4 years ago

Was this helpful?

wireshark filter