Wireshark远程抓包

Wireshark支持remote packet capture protocol协议远程抓包，只要在远程主机上安装相应的rpcapd服务例程就可以
远程抓包的实现步骤：
1，安装或启动rpcapd服务
Windows上只要安装WinPcap软件就行了，它已经包含了rpcapd服务，只要启动就行了
Linux上需要自己编译
Ubuntu下
apt-get install bison flex
wget http://www.winpcap.org/install/bin/WpcapSrc_4_1_2.zip
unzip WpcapSrc_4_1_2.zip
cd winpcap/wpcap/libpcap
chmod +x configure runlex.sh
CFLAGS=-static ./configure
make
cd rpcapd
make
Fedora下
yum install glibc-static
wget http://www.winpcap.org/install/bin/WpcapSrc_4_1_2.zip
unzip WpcapSrc_4_1_2.zip
cd winpcap/wpcap/libpcap
chmod +x configure runlex.sh
CFLAGS=-static ./configure
make
cd rpcapd
make
然后
./rpcapd -n
就运行rpcap服务了

[img]http://dl.iteye.com/upload/attachment/332252/75c55038-00ab-38d9-bb15-5685ca21aaac.png[/img]
./rpcapd -n -d
将以dameon模式在后台运行
2，Wireshark连接远程抓包服务
在InterFace中选择Remote，在弹出的框中输入IP地址点击确定

[img]http://dl.iteye.com/upload/attachment/332244/51d2acca-4cdf-3d00-a72c-c604a2d6e2ae.png[/img]
在右边选择想要监听的网卡

[img]http://dl.iteye.com/upload/attachment/332246/d69df53f-bcbc-39af-ade3-a96a29e78629.png[/img]
最后点Start就开始抓包了

[img]http://dl.iteye.com/upload/attachment/332248/80f2dd9d-7651-3fc6-8268-8737858928a9.png[/img]