windump

最新推荐文章于 2024-04-07 18:27:00 发布

moleng_56

最新推荐文章于 2024-04-07 18:27:00 发布

阅读量445

点赞数

分类专栏：网络文章标签： file interface bbs sns sun cmd

网络专栏收录该内容

1 篇文章 0 订阅

订阅专栏

http://windtear.net/archives/2004/04/05/000244.html D:/>windump -h
windump version current-cvs.tcpdump.org, based on tcpdump version current-cvs.tcpdump.org
WinPcap version 3.0 alpha, based on libpcap version current-cvs.tcpdump.org
Usage: windump [-aAdDeflnNOpqRStuvxX] [-B size] [-c count] [ -C file_size ]
            [ -F file ] [ -i interface ] [ -r file ] [ -s snaplen ]
            [ -T type ] [ -w file ] [ -E algo:secret ] [ expression ]

% tcpdump -h
tcpdump version 3.6.3
libpcap version 0.6
Usage: tcpdump [-adeflnNOpqRStuvxX] [-c count] [ -F file ]
            [ -i interface ] [ -r file ] [ -s snaplen ]
            [ -T type ] [ -U user ] [ -w file ] [ expression ]

发信人: windtear (看成败  人生豪迈), 信区: THUNet
标  题: [简易FAQ] 怎么知道谁中毒了
发信站: BBS 水木清华站 (Sun Nov  2 21:22:21 2003), 转信

[简易FAQ] 怎么知道谁中毒了

Q:    怎么知道谁中毒了
A：    抓包

Q:    怎么抓包
A:    WinDump

Q:    哪里有
A:    http://windump.polito.it/

Q:    连不上
A:    用代理或者
      http://ipcn.org/windump/WinDump.exe
      http://ipcn.org/windump/WinPcap_3_0.exe

      (如果不想用 alpha 版本
      http://ipcn.org/windump/WinDump.v3.6.2.exe
      http://ipcn.org/windump/2.3-WinPcap.exe
      )

Q:    怎么用
A:    先装 WinPcap_3_0.exe
      再装 WinDump.exe
      开始->运行
      %SystemRoot%

      拷贝粘贴 WinDump.exe
      开始->运行
      cmd
      WinDump.exe -h

Q:    看不懂
A:    http://windump.polito.it/docs/manual.htm
      http://windump.polito.it/misc/faq.htm

A:    WinDump.exe -nn icmp

21:06:50.845294 IP 166.111.168.203 > 166.111.169.255: icmp 72: echo request seq 16436
21:06:51.023851 IP 166.111.168.203 > 166.111.170.17: icmp 72: echo request seq 21044
21:06:51.063603 IP 166.111.168.203 > 166.111.170.21: icmp 72: echo request seq 22068
21:06:51.133730 IP 166.111.168.203 > 166.111.170.28: icmp 72: echo request seq 23860
21:06:51.163858 IP 166.111.168.203 > 166.111.170.31: icmp 72: echo request seq 24628
Q:    谁中毒了
A:    166.111.168.203

Q:    我只想要 238 段的
A:    WinDump.exe -nn icmp and src net 166.111.238.0/24

Q:    怎么知道中毒的166.111.168.203是谁
A:    如是静态IP：看静态IP分配信息
      如不是：
      ping 166.111.168.203
      arp -a
      找到 166.111.168.203 的 mac
      166.111.168.203    00-50-ba-45-91-6f    dynamic
      00-50-ba-45-91-6f

Q:    然后呢
A:    到 3900(3300) 1100 查哪个端口
A:
--_-->  3900
Address found on port 17:
   Canonical address    Type
   00-50-ba-45-91-6f Dynamic
or ---->       3900www
Success!
Address found on port 17
----->  1100
Location       VLAN ID Permanent
Unit 1 Port 12    1    No

Q:    不会
A:    发信到 sns_noc@mails.tsinghua.edu.cn