嗅探程序Wireshark(支持Vista)

Wireshark 的前身就是1997年Gerald Comb写的Ethereal.

Wireshark 支持在vista下进行嗅探,还可支持Windows 2000, XP Home, XP Pro, XP Tablet PC, XP Media Center, Server 2003, Windows 2008,以及Apple Mac OS X,Debian GNU/Linux,FreeBSD,Gentoo Linux,HP-UX,Mandriva Linux,NetBSD,OpenPKG,Red Hat Fedora/Enterprise Linux,rPath Linux,Sun Solaris/i386,Sun Solaris/Sparc.他需要winpcap支持,winpcap的核心是NPF(Netgroup Packet Filter) driver.

在运行wireshark进行嗅探前要运行NPF driver,执行如下指令运行NPF driver:

net start npf

否则会报错: "The NPF driver isn't running..."

以上命令在每次运行wireshark前都要执行,如果要避免这个麻烦,可以让NPF driver一直运行,执行如下指令将其变成自动运行的服务即可:

sc config npf start= auto

 

停止 NPF driver:

net stop npf

 

Each NIC in the system gets assigned a GUID by Windows when the NIC gets discovered (though I don't know if those GUIDs will change if the NIC goes away and comes back; they might). When the npf driver starts up, it looks at all the installed network cards, and creates a /Device/NPF_<copy of the GUID> device that user programs can use to talk to npf itself. The WinPcap API uses this interface to capture packets.

 

下载地址:

http://www.winpcap.org/install/default.htm

http://www.wireshark.org/download.html

 

有关NPF:

http://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/packet-capture/winpcap/docs/docs31/html/group__NPF.html