WireShark 安装及帧格式解析（以太帧、IP包、ARP包）

柔情只为你懂 2023-02-13 11:59 29阅读 0赞

###  ###

*  WireShark 安装
 *  WireShark 帧格式解析
 *   *  数据链路层
     *  网络层
     *  ARP
     *   *  ARP 请求包
         *  ARP回应包

# WireShark 安装 #

>  软 件 下 载 链 接 我 放 在 了 文 末 \\color\{red\}软件下载链接我放在了文末 软件下载链接我放在了文末

*  安装的话，直接一路默认就ok，中间有个安装路径换一下就好了。

# WireShark 帧格式解析 #

## 数据链路层 ##

![format_png][]

<table> 
 <thead> 
  <tr> 
   <th>Ethernet II</th> 
   <th>以太网协议版本 II</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Source: IntelCor_49:30:59 （厂名_序号）(38:ba:f8:49:30:59) （网卡地址）</td> 
   <td>源地址</td> 
  </tr> 
  <tr> 
   <td>Destination: TaicangT_3d:9b:a8 （厂名_序号） (6c:c6:3b:3d:9b:a8) （网卡地址）</td> 
   <td>目的地址</td> 
  </tr> 
  <tr> 
   <td>Type: IPv4 (0x0800)</td> 
   <td>协议类型</td> 
  </tr> 
 </tbody> 
</table>

## 网络层 ##

<table> 
 <thead> 
  <tr> 
   <th>Src: 192.168.1.5</th> 
   <th>源地址</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Dst: 203.119.247.189</td> 
   <td>目的地址</td> 
  </tr> 
  <tr> 
   <td>Version: 4</td> 
   <td>互联网协议 IPv4</td> 
  </tr> 
  <tr> 
   <td>Header Length: 20 bytes (5)</td> 
   <td>IP包头部长度</td> 
  </tr> 
  <tr> 
   <td>Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)</td> 
   <td>差分服务字段</td> 
  </tr> 
  <tr> 
   <td>Total Length: 41</td> 
   <td>IP 包的总长度</td> 
  </tr> 
  <tr> 
   <td>Identification: 0x3e8f (16015)</td> 
   <td>标志字段</td> 
  </tr> 
  <tr> 
   <td>Flags: 0x4000, Don’t fragment</td> 
   <td>标记字段（在路由传输时，是否允许将此IP 包分段）</td> 
  </tr> 
  <tr> 
   <td>Fragment offset: 0</td> 
   <td>分段偏移量（将一个IP 包分段后传输时，本段的标识）</td> 
  </tr> 
  <tr> 
   <td>Time to live: 128</td> 
   <td>生存期 ITL</td> 
  </tr> 
  <tr> 
   <td>Protocol: TCP (6)</td> 
   <td>上层协议</td> 
  </tr> 
  <tr> 
   <td>Header checksum: 0x0000 [validation disabled]</td> 
   <td>头部数据的校验和</td> 
  </tr> 
  <tr> 
   <td>[Header checksum status: Unverified]</td> 
   <td>头部数据的校验和状态</td> 
  </tr> 
  <tr> 
   <td>Source: 192.168.1.5</td> 
   <td>源IP 地址</td> 
  </tr> 
  <tr> 
   <td>Destination: 203.119.247.189</td> 
   <td>目的IP 地址</td> 
  </tr> 
 </tbody> 
</table>

## ARP ##

> 捕获一个ARP协议过程，解释相应的值

### ARP 请求包 ###

![format_png 1][]

> Address Resolution Protocol (request)

<table> 
 <thead> 
  <tr> 
   <th>Hardware type: Ethernet (1)</th> 
   <th>硬件类型</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Protocol type: IPv4 (0x0800)</td> 
   <td>协议类型</td> 
  </tr> 
  <tr> 
   <td>Hardware size: 6</td> 
   <td>硬件长度</td> 
  </tr> 
  <tr> 
   <td>Protocol size: 4</td> 
   <td>协议长度</td> 
  </tr> 
  <tr> 
   <td>Opcode: request (1)</td> 
   <td>操作</td> 
  </tr> 
  <tr> 
   <td>Sender MAC address: TaicangT_3d:9b:a8 (6c:c6:3b:3d:9b:a8)</td> 
   <td>发送方 MAC</td> 
  </tr> 
  <tr> 
   <td>Sender IP address: 192.168.1.1</td> 
   <td>发送方 IP</td> 
  </tr> 
  <tr> 
   <td>Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)</td> 
   <td>目标 MAC</td> 
  </tr> 
  <tr> 
   <td>Target IP address: 192.168.1.4</td> 
   <td>目标 IP</td> 
  </tr> 
 </tbody> 
</table>

### ARP回应包 ###

![format_png 2][]

> Address Resolution Protocol (reply)

<table> 
 <thead> 
  <tr> 
   <th>Hardware type: Ethernet (1)</th> 
   <th>硬件类型</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Protocol type: IPv4 (0x0800)</td> 
   <td>协议类型</td> 
  </tr> 
  <tr> 
   <td>Hardware size: 6</td> 
   <td>硬件长度</td> 
  </tr> 
  <tr> 
   <td>Protocol size: 4</td> 
   <td>协议长度</td> 
  </tr> 
  <tr> 
   <td>Opcode: reply (2)</td> 
   <td>操作</td> 
  </tr> 
  <tr> 
   <td>Sender MAC address: IntelCor_49:30:59 (38:ba:f8:49:30:59)</td> 
   <td>发送方 MAC</td> 
  </tr> 
  <tr> 
   <td>Sender IP address: 192.168.1.5</td> 
   <td>发送方 IP</td> 
  </tr> 
  <tr> 
   <td>Target MAC address: TaicangT_3d:9b:a8 (6c:c6:3b:3d:9b:a8)</td> 
   <td>目标 MAC</td> 
  </tr> 
  <tr> 
   <td>Target IP address: 192.168.1.1</td> 
   <td>目标 IP</td> 
  </tr> 
 </tbody> 
</table>

>  W i r e S h a r k 下 载 链 接 \\color\{red\}WireShark 下载链接 WireShark下载链接  
> 链接：https://pan.baidu.com/s/1PqImWwe0FusjbYiDOBHt5A  
> 提取码：qnhp

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9ncmFwaC5iYWlkdS5jb20vcmVzb3VyY2UvMTIxZjM1ZDkxYjYxNzVhYWE3ZDJhMDE1OTA3MjYxMjguanBn?x-oss-process=image/format,png
[format_png 1]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9ncmFwaC5iYWlkdS5jb20vcmVzb3VyY2UvMTIxNmY5ZGU3OGZiODE4NDJmYmViMDE1OTA3MjQ0OTkuanBn?x-oss-process=image/format,png
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9ncmFwaC5iYWlkdS5jb20vcmVzb3VyY2UvMTIxYjg3MmFhZmJhZWU4NjlkYzJiMDE1OTA3MjQ1MzMuanBn?x-oss-process=image/format,png