tshark(wireshark) 学习应用.docx

tshark (wireshark) 学习应用应用示例：01:[root@Nagios341 ~]# tshark -i 1 -w /var/tshark/tshark.log -b filesize:8096 -b files:8 $在后台实时运行tshark 来捕获数据包到文件，指定文件大小为8M左右，只保留8个最新文件，一边对采集的文件作进一步分析处理。输出文件示例[root@Nagios341 tshark]# lltotal 98788-rw 1 root rootNov 24 04:52 tshark_00011_20121124034337.log-rw 1 root rootNov 24 06:00 tshark_00012_20121124045201.log-rw 1 root rootNov 24 07:08 tshark_00013_20121124060002.log-rw 1 root rootNov 24 08:16 tshark_00014_20121124070826.log-rw 1 root rootNov 24 09:24 tshark_00015_20121124081612.log-rw 1 root rootNov 24 10:32 tshark_00016_20121124092428.log-rw 1 root rootNov 24 11:10 tshark_00017_20121124103223.log-rw 1 root rootNov 24 11:10 tshark_00018_20121124111015.log-rw 1 root rootNov 24 11:42 tshark_00019_20121124111045.log-rw 1 root root? 8796778 ?Nov 24 12:20 tshark_00020_20121124114223.log[root@Nagios341 tshark]#?02:[root@Nagios341 ~]# tshark -i 1 -c 2000 -f tcp dst port 443捕获 tcp，目的端口为443 的流量，捕获数量为2000个。安装：[root@Nagios341 ~]# yum install wiresharkInstalling:?wireshark???????? x86_64???????? 1.2.15-2.el6_2.1?????????? base????????? 11 MInstalling for dependencies:?libsmi??????????? x86_64???????? 0.4.8-4.el6??????????????? base???????? 2.4 M[root@Nagios341 ~]# tshark -vTShark 1.2.15Copyright 1998-2011 Gerald Combs mailto:gerald@gerald@ and contributors.This is free software; see the source for copying conditions. There is NOwarranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.Compiled (64-bit) with GLib 2.22.5, with libpcap 1.0.0, with libz 1.2.3, withoutPOSIX capabilities, with libpcre 7.8, with SMI 0.4.8, without c-ares, withoutADNS, without Lua, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with MIT Kerberos,without GeoIP.Running on Linux 2.6.32-279.5.1.el6.x86_64, with libpcap version 1.0.0, GnuTLS2.8.5, Gcrypt 1.4.5.Built using gcc 4.4.6(Red Hat 4.4.6-3).[root@Nagios341 ~]#?[root@Nagios341 ~]# tshark -hTShark 1.2.15Dump and