window下使用wireshark远程抓包简介

1、简介

     首先要在我们需要被抓包的remote机器上确保安装了WinPcap，尽量找最新的版本，安装路径按默认即可。在remote端，进入命令行模式下，切换到winpcap的路径下：C:\Program Files\WinPcap，运行rpcapd -h，可以看到各个参数的用法，下面列出参数的用法：

C:\Program Files\WinPcap>rpcapd.exe -h 
USAGE: 
 rpcapd [-b <address>] [-p <port>] [-6] [-l <host_list>] [-a <host,port>] 
        [-n] [-v] [-d] [-s <file>] [-f <file>] 
  -b <address>: the address to bind to (either numeric or literal). 
      Default: it binds to all local IPv4 addresses 
  -p <port>: the port to bind to. Default: it binds to port 2002 
  -4: use only IPv4 (default both IPv4 and IPv6 waiting sockets are used) 
  -l <host_list>: a file that keeps the list of the hosts which are allowed 
      to connec