Download presentation
Presentation is loading. Please wait.
Published byClarence Black Modified over 9 years ago
1
Ethereal (Network Protocol Analyzer) 2006. 5. 9 백 일 우 steigensonne@hufs.ac.kr
2
2 Install – Winpcap (1/2) ‘Winpcap’ ‘ethereal’ 순서로 설치 Winpcap (Windows Packet Cature Library) http://winpcap.polito.it/
3
3 Install – Winpcap (2/2)
4
4 Install – Ethereal (1/3) http://www.ethereal.com
5
5 Install – Ethereal (2/3)
6
6 Install – Ethereal (3/3)
7
7 Packet capture – Intro (1/4) Packet sniffer structure kernel
8
8 Packet capture – Intro (2/4) Packet sniffer Linux - tcpdump Shell 에서 명령어 형태로 packet capture
9
9 Packet capture – Intro (3/4) Ethereal Open source (Freeware) Compiled wirth GTK, Glib, libpcap 다양한 platform 지원 MAC OS X Windows Linux, Fedora (OS 설치시 선택 가능 ) FreeBSD Solaris
10
10 Packet capture – Intro (4/4) Supported protocols ‘Help’ ‘supported protocols’ 605 개의 protocol 지원
11
11 User Interface Ethereal (1/8)
12
12 Ethereal (2/8) User Interface (con’t) Layer 2 Layer 3 Layer 4 Layer 7
13
13 Ethereal (3/8) Menu Start a capture Open a capture file Save a capture file Stop Reload this capture file Print packet Find packet Find the previous matching packet Find the next matching packet Go to the packet number Go to the first packet Go to the last packet Zoom in/out Zoom 100% Edit capture filter Edit/apply display filter Edit coloring rule Edit preference
14
14 Ethereal (4/8) Filter menu Open the “display filter” dialog Enter a display filter Add an expression to this filter string Apply this filter string to the display Clear this filter string
15
15 Ethereal (5/8) Capture options Interface 선택 Buffer size 설정 각 packet 의 capture size 제한 적용할 Capture filter 설정 저장할 file name Packet capture 를 멈출 조건을 설정 Real-time 으로 packet list 를 update 가장 최근에 capture 된 list 로 auto-scrolling MAC address 의 vendor 표시 Network layer 에서의 name resolution Ex> domain name
16
16 Ethereal (6/8) Packet capture 예제
17
17 Ethereal (7/8) ‘Statistics’ ‘Summary’
18
18 Ethereal (8/8) ‘Statistics’ ‘Protocol hierarchy statistics’
19
19 Follow tcp stream – (1/2)
20
20 Follow tcp stream – (2/2)
21
21 Display filter 기본 문법 정의표현 And&&, and Or||, or Not!, not Equal==, eq Not equal!=, ne Greater than>, gt Less than<, lt Greater than or equal to>=, ge Less than or equal to<=, le
22
22
23
23 Filter command – (1/9) Ethernet (eth) eth.addr : source or destination MAC address eth.dst : destination MAC address eth.src : source MAC address eth.type : type (ARP : 0x0806, IP : 0x0800) Destination addrSource addrtype 6 byte 2byte Ethernet frame format
24
24 Filter command – (2/9) Ethernet frame capture 예제 Destination addrSource addrtype 6 byte 2byte Ethernet frame format
25
25 Filter command – (3/9) IP (ip) ip.addr : source 와 destination IP address ip.src : source IP address ip.dst : destination IP address ip.version : IP version ip.protocol : next level protocol Ip.ttl : TTL(time to live) IP datagram header
26
26 Filter command – (4/9) IP packet capture 예제 IP datagram header
27
27 Filter command – (5/9) TCP (tcp) tcp.srcport : source port tcp.dstport : destination port tcp.port : source/destination port tcp.seq : sequence number tcp.ack : acknowledgement number tcp.len : segment length TCP header format
28
28 Filter command – (6/9) TCP packet capture 예제 TCP header format
29
29 Filter command – (7/9) UDP (udp) udp.srcport udp.dstport udp.port udp.length UDP header format
30
30 Filter command – (8/9) Echo (echo) echo.request echo.response MSN messenger (msnms)
31
31 Filter command – (9/10) HTTP (http) http.request http.response
32
32 Filter command 예제 #1 : 220.67.124.138~220.67.124.170 의 IP Packet 을 capture
33
33 Filter command 예제 #2 : MSN messenger (login 의 경우 )
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.