zoukankan      html  css  js  c++  java
  • Windows 使用windump进行循环抓包

    准备工作

    1、下载tcpdump 
    http://www.winpcap.org/windump/ 
    2017_03_18_at_1_42_PM

    2、下载WinPcap
    http://www.winpcap.org/install/bin/WinPcap_4_1_3.exe

    安装

    1、安装Winkpcap 双击运行->下一步->完成
    2、移动WinDump.exe到C盘根目录下

    使用

    cd到C盘根目录
    1、查看帮助信息

    C:>WinDump.exe -h
    WinDump.exe version 3.9.5, based on tcpdump version 3.9.5
    WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
    Usage: WinDump.exe [-aAdDeflLnNOpqRStuUvxX] [ -B size ] [-c count] [ -C file_size ]
                    [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
                    [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
                    [ -W filecount ] [ -y datalinktype ] [ -Z user ]
                    [ expression ]

    2、查看网卡信息
    通过systeminfo确认网卡顺序(只提取了网卡部分,网卡信息一般在命令结果的最下方):
    2017_03_18_at_3_54_PM

    进行对比得知,序号1位内网网卡,序号2位公网网卡。

    2017_03_18_at_3_54_PM1

    3、抓包显示

    C:>WinDump.exe -i 2
    WinDump.exe: listening on DeviceNPF_{F08820B5-CE29-4149-8F61-AAD4AA472523}
    14:01:10.382760 IP iZddso65qb9n1sZ.3389 > xxx.xx.xx.xx.6800: P 1424906657:1424906822(165) ack 1778482190 win 8419 <nop,nop,timestamp 952070
     935655340>
    5 packets captured
    19 packets received by filter
    0 packets dropped by kernel

    4、循环抓包

    最大抓取50个包,每个包1M
    相关参数可以调整。

    C:>WinDump.exe -i 2 -C 1 -W 50 -w c:3389.pcap tcp and port 3389
    WinDump.exe: listening on DeviceNPF_{F08820B5-CE29-4149-8F61-AAD4AA472523}
    
    91381 packets captured
    100856 packets received by filter
    9405 packets dropped by kernel

    2017_03_18_at_2_20_PM

    抓包时CMD窗口不可关闭,如果关闭,抓包将停止。

     

    from:https://yq.aliyun.com/articles/72447

  • 相关阅读:
    梯度下降算法 (转)
    机器学习
    杭电1097-A hard puzzle
    动态规划初步习题(紫书)
    4.21考试题解
    【bzoj4445 scoi2015】小凸想跑步
    【bzoj4444 scoi2015】国旗计划
    【bzoj4443 scoi2015】小凸玩矩阵
    【luogu P4007 清华集训2017】小Y和恐怖奴隶主
    【luoguP4006 清华集训2017】小Y和二叉树
  • 原文地址:https://www.cnblogs.com/lidabo/p/9635784.html
Copyright © 2011-2022 走看看