Wireshark 远程抓包

Wireshark支持remote packet capture protocol协议远程抓包,只要在远程主机上安装相应的rpcapd服务例程就可以
远程抓包的实现步骤:
1,安装或启动rpcapd服务
Windows上只要安装WinPcap软件就行了,它已经包含了rpcapd服务,只要启动就行了
Linux上需要自己编译
Ubuntu下
apt-get install bison flex
wget http://www.winpcap.org/install/bin/WpcapSrc_4_1_2.zip
unzip WpcapSrc_4_1_2.zip
cd winpcap/wpcap/libpcap
chmod +x configure runlex.sh
CFLAGS=-static ./configure
make
cd rpcapd
make
Fedora下
yum install glibc-static
wget http://www.winpcap.org/install/bin/WpcapSrc_4_1_2.zip
unzip WpcapSrc_4_1_2.zip
cd winpcap/wpcap/libpcap
chmod +x configure runlex.sh
CFLAGS=-static ./configure
make
cd rpcapd
make
然后
./rpcapd -n
就运行rpcap服务了



./rpcapd -n -d

将以dameon模式在后台运行


问题1:
./configure执行到最后出错   
checking for perl... /usr/bin/perl   
checking for bison... no   
checking for byacc... no   
checking for yacc... no   
configure: error: I couldn't find yacc (or bison or ...); make sure it's installed and in your path  
./configure执行到最后出错
checking for perl... /usr/bin/perl
checking for bison... no
checking for byacc... no
checking for yacc... no
configure: error: I couldn't find yacc (or bison or ...); make sure it's installed and in your path

解决办法:
sudo apt-get install flex bison  
sudo apt-get install flex bison

yacc(Yet Another Compiler Compiler),是Unix/Linux上一个用来生成编译器的编译器(编译器代码生成器)。

如想深入了解google下。

问题2:
configure: error: Header file pcap.h not found; if you installed libpcap from source, did you also do "make install-incl", and if you installed a binary package of libpcap, is there also a developer's package of libpcap,   
and did you also install that package?  
configure: error: Header file pcap.h not found; if you installed libpcap from source, did you also do "make install-incl", and if you installed a binary package of libpcap, is there also a developer's package of libpcap,
and did you also install that package?

问题原因是ubuntu下缺少pcap.h等文件。

解决方法:

编译安装libpcap.

www.tcpdump.org页面中可下载源码:libpcap-1.0.0.tar.gz

cd到文件目录:
$tar -xvf libpcap-1.0.0.tar.gz   
$cd libpcap-1.0.0.tar.gz   
$./configure   
$make   
$sudo make install




2,Wireshark连接远程抓包服务
在InterFace中选择Remote,在弹出的框中输入IP地址点击确定


在右边选择想要监听的网卡


最后点Start就开始抓包了

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 2
    评论
评论 2
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值