網(wǎng)絡層數(shù)據(jù)包抓包分析

NaTbneSounctU0.&S39B41?2.lSa.40.Si4ES.27i437l?.i￡a.40.SlOesjinariJortU4.3JF35C71?.4L3H9*￡.6543651171899.^00050Z3>?9.-3172?13267NaTbneSounctU0.&S39B41?2.lSa.40.Si4ES.27i437l?.i￡a.40.SlOesjinariJortU4.3JF35C71?.4L3H9*￡.6543651171899.^00050Z3>?9.-3172?13267。.審gg說31716.171351192.1C?頊51119.140.74.<?LS2.LCB.40.71121.125.115-10192.1^040^1192.1C8iO51.LULi4.QD^ifiZ1JR.16B.4D.51101.4.bO-2141?2.168.40.Si1197i.222.Z319ZIM.JO.51lZ3.121ill.VilDifl2.it￡.4O.51123.12S.112.2a123.1Z&.U12.2619ZIM.40.511D1.4.6O.214i!32.ii&S.4O.5i123.12S.112.Q￥I12.40783511ML?.-?95ZZTHLO17.2SQ331137114.443202i+01W.“白9“1G21Sfi.15134Iliain51.1-92.偵51.OSiiri.ZZZ.Zl142.168.40.SILK2.Ua.4i>.51119TJ.22J.231197^.222.2319ZIM.40.71E4.220E4.22fl123.i2S.112.2i31519G￡H『1*!l?enaticnl&：「?BVM*rMOrdENnLon4^「d?!SEiCI*9CH9€SE；r!^C*aiWMAl維B賓憤35J[KPsegrerrtofareassenfelcdPEHj]SET/ip.lat.ptpHTTP.-l.L242MTTP/1.12DOOK(EtiNC/htHl^41■&[tcpsiagfAinofafcu]i22[tefsearenroTareasset>i?ipcu]312G￡T/y3；53f<wp_ippcicab?MMjpd3te-tri>rfpid-309OMu1d-l*rid-t2CMffTOcZiill15BOHTiP/l,13D2Ter-pcr*r1ly(tejct.-htnl)g5yv3/,5sf--tLp_spp64.cab?autoupdai：fl-tru^pid-3na-OB*uic^lSffid^204ffrDc244Sl272[TCPSagfAiYtOfAFEU]42-4[tcpsiagfAinofafcu]551ffiT/!1?ca-enotion*cn-avat#-i-ordZe?<551/I?cg-wwt1onficn-av?wi-ordZeracIcri^rd-iSg-M^SE'PbflSWJ'Wi'SAl^BFSeM1叩尊[KFsegrerrtofareasstn&ledPCHs]taKget/u1n/gtiif?r1d-b2CMff7Oc244gi3^66fO6Sa322fDiuArypa-i2^u>-0l^a1M4-GSget/iifl.hCHr?wr-34r-14iSi!http/'I-i416[repsagramofafeu]q跆否JUFs.iTT日?+wwri-?F?,r■!eJU^i「H?WHff*JIIf*：**cgAiwipwmImFraro15:21Jbye皿onwire(ZD1Gbits).252capcurod口QI。bics)oninrarFaEQu?EThtirnACee,SfC\HSh-l*TTP_-Bd:Of:dd0.i2:ic:isd-Crf.dd},est.HSr*ig2hau_^f.4h:22_d￡.if:&￡■:46)sfYEdrnACPraTOCQl￥』「W*i5l,sre:1^2.1^8.4-0..MTJ11^.146.~4.4B0100..-versinnr日<r1HA771MEHmimin51iXliiiddOQOiCOOiOiiOiOiiOiMliiliiOMOiOflOiOOOiiOiMiggliXdOOiti000111DDWOWQQQCiXOOQOCloiwaoio1110110111101110noiiMM□□□□1111110111D101Q0QW1lOllllinllDDOOXiiCadlOODiiooooioocaooioiC■:■:CIMDOlCKKKWOCVLCrLMDOCKKKKHODDD&：■：■：■：<QOQWOW0D11CO110101WW01QDD1D1QlfflWWe01110111O1QDU101i：■:■:"MnDDWMW110lozaaflii]iiHaon實驗內容（1）使用Wireshark軟件抓取指定IP包。（2）對抓取的數(shù)據(jù)包按協(xié)議格式進行各字段含義的分析。實驗步驟（1）打開Wireshark軟件，關閉已有的聯(lián)網(wǎng)程序（防止抓取過多的包），開始抓包；（2）打開瀏覽器，輸入/網(wǎng)頁打開后停止抓包。（3）如果抓到的數(shù)據(jù)包還是比較多，可以在Wireshark的過濾器（filter）中輸入http，按“Apply”進行過濾。過濾的結果就是和剛才打開的網(wǎng)頁相關的數(shù)據(jù)包。4-LDMP(WnaiiH-kFn=mmmJb?r-2ja||FifiEdc宜wGatapcif4StxAkf-T出Qha州Tuk北HaM€-8i■rB"Xa?下主改回國耳回叫蜀3imauan._CkarApp4pProwcoiLengihmfatcf3&8[tcpsiagrainofarAASis-tn^l?dpcu]無尸推;1[tcf8“gi1如natartia-￡-￡-Hd>l-tdfeu]karfa:karfa:oiiwoiouiiiwioooiiiioiiiiooino01000001iniwoiooininnoowoiioourjKiBiliflrtflrtflJiBJJRBillHii1r*nJrljJJiffIUBiRfiilflilFta:"C^.UMi^iADNDi^L'/iixsDaQ'iLxia^丑再1Cvofarad:23DrwoaiLQ（4）在過濾的結果中選擇第一個包括httpget請求的幀，該幀用

于向/網(wǎng)站服務器發(fā)出httpget請求(5)選中該幀后，點開該幀首部封裝明細區(qū)中InternetProtocol前的”+”號，顯示該幀所在的IP包的頭部信息和數(shù)據(jù)區(qū)：,55a3^150101&2.1&B.4O.51LL&.146.7^/18HTTP252GET/list^/imeHTTP/1.1iflFrame55;252bytesonwire(201Sbiis).252byxescsprur^d<2016bits)anImerfacfiQStInternetProtocalVersion4SSrcz192.166..40.515Dst;119,146.74.-48aEiheriiiifiLiiParc:HewlenLP_edzOf:dd(f0:92:1czed:Of:StInternetProtocalVersion4SSrcz192.166..40.515Dst;119,146.74.-480100...?=Version:4....0101=HeaderLength:20bytes田DifferentiatedservicesField:DxooCdscp:csoBecn：Not-ECT)ToralLength:zaaideirirlf1cation:Qxllbe(16B3Q>田f1ags:0x02(Don,TFragment)Fragmentoffset:0TimeTolive:64Protocol:TCP〔6)0000001000200030OMOnnm29fo6484bB4c40000001000200030OMOnnm29fo6484bB4c45574a44§foos『so￡?ooo002?5eu?IA276723d3a7oTo957(6)數(shù)據(jù)區(qū)目前以16進制表示，可以在數(shù)據(jù)區(qū)右鍵菜單中選擇“BitsView”以2進制表示:■55a.3^166101&2.1&E.4O.51115.146.7^/18HTTP252GET/list^/imeHTTP/1.1mFrame55：252bytesonhire(20-16blrs).252byiLesca：pLiir@d(201fibits)onIriLerfdCfiQEErhernieLussre:Hewl(@LLP_fldzof:ddCf0：92:1czed:Qf:dd)qejsl:Hang2hou_9f:Sd:46(3E：22：dfMInternetProtocolVersion4SSrc:192.166.40,51sDstz119.14*5-74.^90100....=Version:4....0101=HeaderLengths20byt&s田Differentiated5erv1cesField:DxooCdscp:csoBech：Not-ECT)Tora.1Length:233ideifirlfictions0x41b@(16B3O>田Flags:OxO2(D&n,iFragineiit)Fragmentoffset:0Time"tolive:64Pratacal:TCP〔6)8ososnD1122>oooooAoo8ososnD1122>oooooAoooooA000i.ilCK}111011。！QOCmJLJLJLLLQJLLlLOl。。。。。。。。田HOOCHM000000001lOTOOOUIJ1110111001000TFD1101111100100QDDD000000000100DDDD00000110|mooQm100101&□QOOOOOQD0110000110101000OT101DDD0011001101100010nnA/winn.Dill0010llOOOUlO00111101HAHAHfHI唾0010010111100100ETTT■!Tn00000uuuoiooaooiAAAA/in.n.rt.OlOl-OOuu10100010AAAAAAAAO111D1111001001001000101110010110101000000011000A/irt-np』eii"■凡凡trn0LmernetProtocol0LmernetProtocolVersionSrc:1,Dst:119.1^-6.74.4130100??v&rslon:45533466101^166.405111&14674J&HTTP252GET/liEK/imeHTTP/1.1mEthernetirrEre：HewlettP_ed:Of:ddCf0:92!lc：ed:0f:dd).Dst:Hangzhou_9f(購：蕓：小，...u0101=HeaderLength:20bytes田DifferentiatedServicesF-ield:DxDO(DSCP:CSOaECW:Not-ECT；TotalLength：238identification:0x41beCL883。)mFlags:0*02(Dori^TFragineiiic)Fragmentoffset:0Timet口11ve:64Protocol:TCP〔6)i±iHeaderchecksum:0x0000rvalidariondisabledlSososAqi-l?』3oooooAoooooA00011100OOOWICH}01001CHQ0110001Q1110110111101110D0000000D01100000111001000001111oioooQin11000010001111QIHAHAHfHI唾SososAqi-l?』3oooooAoooooAOOOOQQQQoooooooo00110011010100001010001010OD1D1I010000000111Dill010001010101QQQQoooooooo000001101001.00101100101100011000m尸■凡凡TiTH-(3w.3D.PE.br=uA-P.aj-r■558.M661018HTTP252GET/lists/imeHTTP/1.1?EthernetII9Src:HewlettP_ed:0f:dd(f0:92:lc:ed:0f:dd).Dst:Hangzhou_9f:84:46(38:22:d<*QInternetProtocolVersion4,Src:1.Dst:80100...?=Version:4....0101=HeaderLength:20bytesGDDifferentiatedServicesField:0x00(D5CP:CSO,ECN：Not-ECT)=TotalLength:238Identification:0x41be(16830)6)Flags:0x02(Don'tFragment)Fragmentoffset:0Timetolive:64Protocol：TCP(6)tejHeaderchecksum:0x0000「validationdisabled!I?rooiome00180000000000000000002001001010001100000028ooiome00180000000000000000002001001010001100000028011000100111001000300100000000000000010000011100000011000010001111011010101110111110101010000010010111100100011111100100000000101000000000000100000100000000000000000011001101010000101000100000000001000000011101110100010101010000010001110000011010010010110010110001100001000101nn?ozzznnnnnnnmmmanzvzaaiahiaairahiaiaaaiiiaairHBa.瓦久.....(3w?JO.%.PE.br-.a.p.低..GE?r/I<..?EthernetII9Src:HewlettP_ed:Of:dd(fO:92:lc:ed:Of:dd).Dst:Hangzhou_9f:84:46(38:22:d<?EthernetII9Src:HewlettP_ed:Of:dd(fO:92:lc:ed:Of:dd).Dst:Hangzhou_9f:84:46(38:22:d<*QInternetProtocolVersion4,Src:1.Dst:80100...?=Version:4....0101=HeaderLength:20bytesSDifferentiatedServicesField:0x00(DSCP:CSO,ECN：Not-ECT)TotalLength:238Identification:0x41be(16830)SFlags:0x02(Don'tFragment)TimetoliveFragmentTimetoliveProtocol：TCP(6)ujHeaderchecksum:0x0000「validationdisabled!ir001000180020002800300000000011101110000000000000000001001010001100000110001000100018002000280030000000001110111000000000000000000100101000110000011000100111001001000000000000000100000111000000110000100011110110101011zzznnnnnnnmi101111100100000010101000001010000010010100000000111001000100000101111110000000000000000000110011010100001010001000000000AlHAA11J100000C011101110100010101010000010001110000011010010010110010110001100001000101A-1-11AlAAAl11AA11JO.%.PE.br-.a.p.低..GE?r/I<..4558.3456101119.146.7448HTTP252GET/lists/imeHTTP/1.1SDifferentnatedServicesField:0x00(DSCP:CSO.ECN：Not-ECT)TotalLength:238Identification:0x41be(16830)(SFlags:0x02(Don'tFragaent)Fragmentoffset:0Timetolive:64protocol:TCP(6)t.Headerchecksum:0x0000[validationdisabled]Source：1Destination:8[SourceGeoIP:Unknown][DestinationGeoIP:Unknown]IF001S0020002800300038nn^a0000000001001010011000100100000001010100AA1△■■■001S0020002800300038nn^a0000000001001010011000100100000001010100AA1△■■■■oooooooo0011000001110010oooooooo00100000nt1A1AA111000000110000100011110110101011001011111010100000100101111001000111111001101100A11AA1八，00101000oooooooo01000001oooooooo01101001AninAAAA001100110101000010100010oooooooo01110011AlAAtAAA011101111001001001000101010100000100011101110100A1A1AlAA11001011000110000100010101110011AlAiniAAJO.%.PE.br=.A.P.fZ—LJTT4558.345610192.l63.40.5l119.146.7448HTTP252GET/lists/imeHTTP/l.lSDifferentiatedServicesField:0x00(DSCP:CSO.ECN：Not-ECT)TotalLength;238idenrlfRation:0x41be(16830)(BFlags:0x02(Don'tFragment)Fragmentoffset:0Timetolive:Protocol:TCP(6)SHeaderchecksum:0x0000[validationdisabled]source:1Destination:8[SourceGeoIP：unknown][gTlnaUonGeoIP：unknown]00180020002800300038ooooooooooooooooggsnsHEEEESEoiioooioin11ooio01000000oooooooo0101010000100000AA1△■■■■m1A1AA111000010001111011010101100101111101010000010100100101111001000111111001101100A11AA1OOOOOOOO01000001oooooooo01101001AninAAAA0101000010100010oooooooo01110011AlAAtAAA01000101010100000100011101110100A1A1AlAA11001011000110000100010101110011AlniAA,黨8,346610192.16^40.5111^146,74,43HTTP252GET/lists/imeHTTP/1,1fflD-ifferentiatedServicesField:0x00(DSCP:C50,ECN:Not-ECT)*Ta-talLength:238Tdentlf1catlon:0x41be〔16日3。)fflFlags:0x02(Don'tFragment)Fragmentoffset:0Tinetolive:64ProtacalsTCP(.6)EHeaderchecksum:0x0000[validationdisabled]!Source:1一liestinatlon:0[SourceGeoIP:Unknown][EbestlnatlonGeoIP: