https://souljian.cn/tags/%E5%8D%8F%E8%AE%AE%E5%88%86%E6%9E%90/Recent content in 协议分析 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088152/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088152/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Wireshark 抓包只在授权网络环境使用。</p> <h2 id="一wireshark-工作流">一、Wireshark 工作流 </h2><img src="https://souljian.cn/img/wireshark-analysis.svg" alt="Wireshark 协议分析实战" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 抓包 → ② 过滤 → ③ 分析 → ④ 导出 → ⑤ 取证 → ⑥ 报告 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二常用过滤器">二、常用过滤器 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">地址：ip.addr == 192.168.1.100 · tcp.srcport == 80 </span></span><span class="line"><span class="cl">协议：tcp · udp · icmp · http · dns · ssl </span></span><span class="line"><span class="cl">内容：tcp.contains &#34;password&#34; · http.request.method == &#34;POST&#34; </span></span></code></pre></td></tr></table> </div> </div><h2 id="三流追踪">三、流追踪 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">右键 → Follow → TCP Stream </span></span><span class="line"><span class="cl">查看完整 HTTP 会话内容 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四分析场景">四、分析场景 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">HTTP：明文密码/Token 泄露 · 导出 HTTP 对象 </span></span><span class="line"><span class="cl">DNS：DNS 隧道 · 域名解析异常 </span></span><span class="line"><span class="cl">TCP：SYN 扫描检测 · TCP 重传分析 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>Wireshark 是网络协议分析和取证的核心工具。掌握过滤器和流追踪，可完成从抓包到取证的完整分析链路。</p>