综合介绍氧教程.pdfVIP

GS-AN001

802.11PacketSniffer

INTRODUCTION

ONEOFthebestwaystolearnaboutaparticulaworkprotocolistowatchreallivetraffic.Thebest

waytodothisiswithaprotocolpacketyzer.Thisissoftwarethatcapturesallpacketsoname-

dium,parsesthemtodetermherelevantprotocols,dissectsthepacketintoitsconstituentfields,and

disysthesefieldsinameaningfulway.IEEE802.11isnoexception.

COMPONENTSOFAN802.11PACKETSNIFFER

Thethreecomponentsrequiredtomakean802.11packetsnifferare:

1.Hostcomputer

2.WLAN(IEEE802.11workinterface

3.Packetysissoftware

Wireshark

Forawhile,themostpopularpacketyzerwasatoolnamedEthereal.Originallyreleasedin1998,

itrapidlygrewinpopularityandscope.Newprotocolscouldbeeasilyadded,soovertimemany

contributorsdevelopednewprotocoldissectors,asneeded.In2006theprojectleftbehindtheEthereal

nameandchangedtoWireshark,butisstillmaintainedbythesamegroupofpeople.

WiresharkrunsonbothWindowsandLinuxoperatingsystems.ForLinux,itreliesonthelibpcap

librarytoperformpacketcapture.OnWindows,theWiaputilityisused.Theseprogramsrelyonthe

networkinterfacecard(NIC)drivertoprovideracketdata.Thepcaputility(libpcaporWiap)then

providesanAPIwhichWiresharkusestoextractpackets.Anypacketcaptureprogramthatcanwrite.pcap

outputfilescsobeusedoffline.

Wiresharkworksverywellforviewingpacketshe.YoucanseeallTCP/IPpackets,aswellas

lowerlevelprotocols,suchasDHCP,ARP,etc.Italsodissectspacketsofhigher-levelprotocols,suchas

FTPorHTTP.Typically,bydefault,Etheworkinterfacedriversonlyprovidepacketstothepcap

utilitythatoriginatefromorareaddressedforthehost’w