求教，刚接触perl 要做一个抓包分析

懒狒狒

{:3_186:} 公司就我一个perl哦回复 10# sjdy521


   

sjdy521

二进制转文本 这个和perl有啥关系

q1208c

回复 8# 懒狒狒

用 tcpdump的命令转呀. 那个需要 wincap的库的.
   

懒狒狒

嗯呐，谢谢了，我在查查文档看看怎么用的哈回复 13# q1208c


   

wsxedcer

回复 1# 懒狒狒


    tshark -r input

1. -r <infile>              set the filename to read from (no pipes or stdin!)

复制代码

懒狒狒

嗯，也不算是吧，我们部门主要是分析当我们的服务器受到攻击的时候能快速的查询出自己想要的参数
回复 16# defendre


   

dsadjkasd

你可以下个010editor帮助你进行16进制或者2进制数据的分析，但数据位数字符型之类都需要自己不断猜测揣摩出规律来，才能进行有效的解码数据成可读的东西。。。比如02FAF080表示50000000，当然你看16进制的时候这个数应该是“80 F0 FA 02”， 抓的包应该分析下报文，报头，需要参考下TCP 和UDP如何封装的。。。

laputa73

那些二进制包是有协议的，不是简单的16进制转转就能识别的
所以tshark是必须的
http://www.wireshark.org/docs/ws ... AppToolstshark.html

1. TShark 1.7.0 (SVN Rev 39165 from /trunk)
   
2. Dump and analyze network traffic.
   
3. See http://www.wireshark.org for more information.
   
4. 
   
5. Copyright 1998-2011 Gerald Combs <gerald@wireshark.org> and contributors.
   
6. This is free software; see the source for copying conditions. There is NO
   
7. warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   
8. 
   
9. Usage: tshark [options] ...
   
10. 
    
11. Capture interface:
    
12.   -i <interface>           name or idx of interface (def: first non-loopback)
    
13.   -f <capture filter>      packet filter in libpcap filter syntax
    
14.   -s <snaplen>             packet snapshot length (def: 65535)
    
15.   -p                       don't capture in promiscuous mode
    
16.   -B <buffer size>         size of kernel buffer (def: 1MB)
    
17.   -y <link type>           link layer type (def: first appropriate)
    
18.   -D                       print list of interfaces and exit
    
19.   -L                       print list of link-layer types of iface and exit
    
20. 
    
21. Capture stop conditions:
    
22.   -c <packet count>        stop after n packets (def: infinite)
    
23.   -a <autostop cond.> ...  duration:NUM - stop after NUM seconds
    
24.                            filesize:NUM - stop this file after NUM KB
    
25.                               files:NUM - stop after NUM files
    
26. Capture output:
    
27.   -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
    
28.                            filesize:NUM - switch to next file after NUM KB
    
29.                               files:NUM - ringbuffer: replace after NUM files
    
30. Input file:
    
31.   -r <infile>              set the filename to read from (no pipes or stdin!)
    
32. 
    
33. Processing:
    
34.   -2                       perform a two-pass analysis
    
35.   -R <read filter>         packet filter in Wireshark display filter syntax
    
36.   -n                       disable all name resolutions (def: all enabled)
    
37.   -N <name resolve flags>  enable specific name resolution(s): "mntC"
    
38.   -d <layer_type>==<selector>,<decode_as_protocol> ...
    
39.                            "Decode As", see the man page for details
    
40.                            Example: tcp.port==8888,http
    
41. Output:
    
42.   -w <outfile|->           write packets to a pcap-format file named "outfile"
    
43.                            (or to the standard output for "-")
    
44.   -C <config profile>      start with specified configuration profile
    
45.   -F <output file type>    set the output file type, default is libpcap
    
46.                            an empty "-F" option will list the file types
    
47.   -V                       add output of packet tree        (Packet Details)
    
48.   -O <protocols>           Only show packet details of these protocols, comma
    
49.                            separated
    
50.   -P                       print packets even when writing to a file
    
51.   -S <separator>           the line separator to print between packets
    
52.   -x                       add output of hex and ASCII dump (Packet Bytes)
    
53.   -T pdml|ps|psml|text|fields
    
54.                            format of text output (def: text)
    
55.   -e <field>               field to print if -Tfields selected (e.g. tcp.port);
    
56.                            this option can be repeated to print multiple fields
    
57.   -E<fieldsoption>=<value> set options for output when -Tfields selected:
    
58.      header=y|n            switch headers on and off
    
59.      separator=/t|/s|<char> select tab, space, printable character as separator
    
60.      occurrence=f|l|a      print first, last or all occurrences of each field
    
61.      aggregator=,|/s|<char> select comma, space, printable character as
    
62.                            aggregator
    
63.      quote=d|s|n           select double, single, no quotes for values
    
64.   -t ad|a|r|d|dd|e         output format of time stamps (def: r: rel. to first)
    
65.   -u s|hms                 output format of seconds (def: s: seconds)
    
66.   -l                       flush standard output after each packet
    
67.   -q                       be more quiet on stdout (e.g. when using statistics)
    
68.   -X <key>:<value>         eXtension options, see the man page for details
    
69.   -z <statistics>          various statistics, see the man page for details
    
70. 
    
71. Miscellaneous:
    
72.   -h                       display this help and exit
    
73.   -v                       display version info and exit
    
74.   -o <name>:<value> ...    override preference setting
    
75.   -K <keytab>              keytab file to use for kerberos decryption
    
76.   -G [report]              dump one of several available reports and exit
    
77.                            default report="fields"
    
78.                            use "-G ?" for more help
    

复制代码

wuluoroad

LZ这个工作做好了吗？我也想做类似的事情，一起交流哈

只爱睡觉

这个工作鄙人早年做过分析cap的包话先用wireshark转成xls，在转成txt，然后在分析。