Wireshark 长时间抓包~~很长很长,肿么办
最近遇到比较麻烦的事情,需要整个晚上甚至更长时间启用Wireshark抓包,分析网络是否有异常,甚至在抓包的同时要开启迅雷等下载软件,或者进行VOIP通话等,鬼知道一晚上抓的包有多大。不管三七二十一,启动wireshark,只管Run(想当然以为,只要硬盘空间够,抓包没问题),试了几回,早上来都崩溃了,以为是wireshark版本问题,可是即使用最新的版本(考虑兼容性问题,放弃windows7,用XP),崩溃依旧~~肿么办????原来在Linux下tcpdump没这么脆弱啊。
找到windows下安装wireshark 的目录,那不是有个 dumpcap.exe 的东东么,靠!应该是命令抓包了,果断的 dumpcap.exe -h ,果然:
D:\Program Files\Wireshark>dumpcap.exe -h
Dumpcap 1.8.0 (SVN Rev 43431 from /trunk-1.8)
Capture network packets and dump them into a pcapng file.
See http://www.wireshark.org for more information.
Usage: dumpcap [options] ...
Capture interface:
-i <interface> name or idx of interface (def: firs
-f <capture filter> packet filter in libpcap filter syn
-s <snaplen> packet snapshot length (def: 65535)
-p don't capture in promiscuous mode
-B <buffer size> size of kernel buffer (def: 1MB)
-y <link type> link layer type (def: first appropr
-D print list of interfaces and exit
-L print list of link-layer types of i
-d print generated BPF code for captur
-S print statistics for each interface
-M for -D, -L, and -S, produce machine
RPCAP options:
-r don't ignore own RPCAP traffic in c
-u use UDP for RPCAP data transfer
-A <user>:<password> use RPCAP password authentication
-m <sampling type> use packet sampling
count:NUM - capture one packet of e
timer:NUM - capture no more than 1
Stop conditions:
-c <packet count> stop after n packets (def: infinite
-a <autostop cond.> ... duration:NUM - stop after NUM secon
filesize:NUM - stop this file after
files:NUM - stop after NUM files
Output (files):
-w <filename> name of file to save (def: tempfile
-g enable group read access on the out
-b <ringbuffer opt.> ... duration:NUM - switch to next file
filesize:NUM - switch to next file
files:NUM - ringbuffer: replace
-n use pcapng format instead of pcap (
-P use libpcap format instead of pcapn
Miscellaneous:
-t use a separate thread per interface
-q don't report packet capture counts
-v print version information and exit
-h display this help and exit
看来就它了,试了一下 dumpcap.exe 报错,OMG,我是上网卡不知道抓哪个,看说明-D后就能识别哪个网卡了,然后……(此处省略500字,废话,谁要看你折腾的过程,赶紧说咋用就行)
结论: dumpcap.exe -i 2 -b filesize:100000 -w d:\test.pcap
至于为什么-i 后是2不是1,正常人都能想到是编号为2 的网卡接口,你咋知道,MG,-D 就是为了了解是哪个interface,剩下的参数,不懂的学英语去。我这会抓包,忙着呢!