Wireshark网络抓包实践

小鱼儿 2022-07-14 07:49 287阅读 0赞

# **1. 网络抓包相关阅读** #

*  [抓包工具Wireshark基本介绍和学习TCP三次握手][Wireshark_TCP]
 *  [Wireshark网络抓包实践][Wireshark]
 *  [HTTP代理神器Fidder][HTTP_Fidder]

# [**2. Wireshark**][2. Wireshark] #

世界上最流行的网络协议分析器，[抓包工具Wireshark基本介绍和学习TCP三次握手][Wireshark_TCP]

![Wireshark][Wireshark 1]

![Wireshark][Wireshark 2]

通过ping命令拿到网址的IP

![Wireshark][Wireshark 3]

## **过滤表达式的规则** ##

<table> 
 <thead> 
  <tr> 
   <th align="left">表达式规则</th> 
   <th align="left">规则说明</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left">协议过滤</td> 
   <td align="left">比如TCP，只显示TCP协议</td> 
  </tr> 
  <tr> 
   <td align="left">IP 过滤</td> 
   <td align="left">比如 ip.src ==192.168.1.102 显示源地址为192.168.1.102，ip.dst==192.168.1.102，目标地址为192.168.1.102</td> 
  </tr> 
  <tr> 
   <td align="left">端口过滤</td> 
   <td align="left">tcp.port ==80, 端口为80的； tcp.srcport == 80, 只显示TCP协议的愿端口为80的</td> 
  </tr> 
  <tr> 
   <td align="left">Http模式过滤</td> 
   <td align="left">http.request.method==”GET”, 只显示HTTP GET方法的</td> 
  </tr> 
  <tr> 
   <td align="left">逻辑运算符</td> 
   <td align="left">AND/ OR</td> 
  </tr> 
 </tbody> 
</table>

## **常用的过滤表达式** ##

<table> 
 <thead> 
  <tr> 
   <th align="left">过滤表达式</th> 
   <th align="left">用途</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left">http</td> 
   <td align="left">只查看HTTP协议的记录</td> 
  </tr> 
  <tr> 
   <td align="left">ip.src ==192.168.1.102</td> 
   <td align="left">过滤源ip地址是192.168.1.102</td> 
  </tr> 
  <tr> 
   <td align="left">ip.dst==192.168.1.102</td> 
   <td align="left">过滤目标ip地址是192.168.1.102</td> 
  </tr> 
  <tr> 
   <td align="left">ip.src ==192.168.1.102 or ip.dst==192.168.1.102</td> 
   <td align="left">源地址或者目标地址是192.168.1.102</td> 
  </tr> 
  <tr> 
   <td align="left">http.request.method==”GET”</td> 
   <td align="left">过滤get请求</td> 
  </tr> 
  <tr> 
   <td align="left">http.request.method==”POST”</td> 
   <td align="left">过滤post请求</td> 
  </tr> 
  <tr> 
   <td align="left">http.request.method==”GET” and ip.dst==192.168.1.102</td> 
   <td align="left"></td> 
  </tr> 
 </tbody> 
</table>

# **Wireshark抓包实战** #

抓取某新闻客户端的数据

## **注意事项** ##

*  在抓取数据之前先清除缓存，缓存会影响抓包

## **过滤get请求** ##

![1240][]

通过ping命令获取新闻数据的目标IP地址，封包信息中网址带有163可能就是新闻客户端的url

![1240 1][]

拿到目标IP地址，就可以通过目标IP地址过滤数据

![1240 2][]

用浏览器打开抓到的url，即可得到新闻的数据

[http://c.m.163.com/nc/article/list/T1467284926140/0-20.html][http_c.m.163.com_nc_article_list_T1467284926140_0-20.html]

![1240 3][]

![1240 4][]

## **新闻分类tid** ##

url组织形式[http://c.m.163.com/nc/article/list/tid/startindex-count.html][http_c.m.163.com_nc_article_list_tid_startindex-count.html]

其中tid是新闻类别的id，startindex是数据的起始索引，count是新闻数据的条数

*  体育T1348649079062
 *  头条T1467284926140
 *  娱乐T1348648517839
 *  要闻T1348647909107

## **新闻Tab标签** ##

[http://c.m.163.com/nc/topicset/android/subscribe/manage/listspecial.html][http_c.m.163.com_nc_topicset_android_subscribe_manage_listspecial.html]

{
        "tList": [ { "template": "normal1", "topicid": "0001899N", "hasCover": false, "weburl": "http://www.163.com/", "alias": "Top News", "subnum": "3.2万", "recommendOrder": 0, "isNew": 0, "hashead": 1, "img": "", "isHot": 0, "hasIcon": false, "cid": "C1348646712614", "recommend": "0", "headLine": true, "hasAD": 1, "color": "", "bannerOrder": 0, "tname": "头条", "ename": "androidnews", "showType": "comment", "special": 0, "tid": "T1348647909107", "ad_type": 1 }, { "template": "normal1", "topicid": "0001899N;000187QQ", "hasCover": false, "alias": "yaowenspecial", "subnum": "10.6万", "recommendOrder": 0, "isNew": 0, "hashead": 1, "img": "", "isHot": 0, "hasIcon": false, "cid": "C1348647991705", "recommend": "0", "headLine": false, "hasAD": 1, "color": "", "bannerOrder": 0, "tname": "要闻", "ename": "yaowenspecial", "showType": "comment", "special": 0, "tid": "T1467284926140", "ad_type": 1 }, { "template": "recommend", "topicid": "00037VVH", "hasCover": false, "weburl": "http://ent.163.com/", "alias": "Entertainment", "subnum": "超过1000万", "recommendOrder": 120, "isNew": 0, "hashead": 1, "img": "T1348648517839", "isHot": 0, "hasIcon": true, "cid": "C1348648351901", "recommend": "1", "headLine": false, "hasAD": 1, "color": "", "bannerOrder": 0, "tname": "娱乐", "ename": "yule", "showType": "comment", "special": 0, "tid": "T1348648517839", "ad_type": 1 } ] }

json数据中的tid即为上文中的新闻类别id

![3981391-e7b266d455078420.jpg][]

![1240 5][]

## **新闻详情页** ##

[http://c.m.163.com/nc/article/docid/full.html][http_c.m.163.com_nc_article_docid_full.html]

[https://c.m.163.com/news/a/docid.html][https_c.m.163.com_news_a_docid.html]

例如：[http://c.m.163.com/nc/article/CG4A99320001899O/full.html][http_c.m.163.com_nc_article_CG4A99320001899O_full.html]

其中CG4A99320001899O是docid，如图所示

![docid][]

![3981391-77301aa2c9cf9e4f.png][]

![1240 6][]

![1240 7][]

[Wireshark_TCP]: http://blog.csdn.net/axi295309066/article/details/62141352
[Wireshark]: http://blog.csdn.net/axi295309066/article/details/53436940
[HTTP_Fidder]: http://blog.csdn.net/axi295309066/article/details/72520536
[2. Wireshark]: https://www.wireshark.org/
[Wireshark 1]: /images/20220714/4fbf18b618af40ed8eb439cf3a008c3d.png
[Wireshark 2]: /images/20220714/c9198960111548f5938663cdd0f7b08c.png
[Wireshark 3]: /images/20220714/47e54f91bb5744ddbe110d65d7649547.png
[1240]: /images/20220714/2322e65b0e9141d1a9b9291a35a4c68e.png
[1240 1]: /images/20220714/89f1a134f080488e8ca475528cddff59.png
[1240 2]: /images/20220714/f80aa36c142348ad9826b63ae5d69ff6.png
[http_c.m.163.com_nc_article_list_T1467284926140_0-20.html]: http://c.m.163.com/nc/article/list/T1467284926140/0-20.html
[1240 3]: /images/20220714/d9041a3e109e4b93892865d7dd9e7ff5.png
[1240 4]: /images/20220714/9e5cc29398d14f7cab7202a09825e846.png
[http_c.m.163.com_nc_article_list_tid_startindex-count.html]: http://c.m.163.com/nc/article/list/tid/startindex-count.html
[http_c.m.163.com_nc_topicset_android_subscribe_manage_listspecial.html]: http://c.m.163.com/nc/topicset/android/subscribe/manage/listspecial.html
[3981391-e7b266d455078420.jpg]: /images/20220714/3f02c9a329ba416c8039312ff08b2eb0.png
[1240 5]: /images/20220714/5f6c214df20141209ead5d47940a0119.png
[http_c.m.163.com_nc_article_docid_full.html]: http://c.m.163.com/nc/article/docid/full.html
[https_c.m.163.com_news_a_docid.html]: https://c.m.163.com/news/a/docid.html
[http_c.m.163.com_nc_article_CG4A99320001899O_full.html]: http://c.m.163.com/nc/article/CG4A99320001899O/full.html
[docid]: /images/20220714/8badb1d3a65c40ba981682f075df3eb5.png
[3981391-77301aa2c9cf9e4f.png]: /images/20220714/fc30bc2472a14433b2a281a94e7bb095.png
[1240 6]: /images/20220714/d71e1b993add49bdb37fa083f3879f9b.png
[1240 7]: /images/20220714/8f47dd1def7b4f22a31791d3af3a47b0.png