第五章报文捕获.pptx

网络报文捕获;一 报文捕获软件（ethreal和wireshark）;Wireshark的特点;主要界面;报文过滤;capture filter设置;capture filter语法和tcpdump相同;capture filter语法和tcpdump相同;capture filter例子;display filter;display filter;display filter;display filter例子;WireShark：Follow TCP Stream;Wireshark: Following a TCP Stream;Wireshark: FTP Control Stream;Wireshark: FTP Data Stream;Wireshark: FTP Data Stream;Wireshark: HTTP Session;WireShark：Follow TCP Stream;WireShark：Follow TCP Stream;WireShark：Export Selected Packet Bytes;WireShark：Export Selected Packet Bytes;WireShark：Export Selected Packet Bytes;WireShark的辅助程序;WireShark的辅助程序;;用Python操作TShark;用Python操作TShark;Wireshark搜集证据;Scanning;Scanning-TCP Connect Scan;Scanning-SYN Scan;Scanning-XMAS Scan;Scanning-NULL Scan;Remote Access Trojans;Trojan-SubSeven Legend;Trojan-SubSeven Legend;Trojan-NetBus;Trojan-NetBus;Worm;Worm-SQL Slammer Worm;Worm-SQL Slammer Worm;Worm-SQL Slammer Worm;Worm-SQL Slammer Worm;Worm-SQL Slammer Worm传播速度快原因;Worm-Code Red Worm;Worm-Code Red Worm传播阶段;Worm-Code Red Worm DOS阶段 Sleep阶段;Worm-Code Red Worm 传播阶段;Worm-Code Red Worm 传播阶段;Worm-Code Red Worm DOS阶段;Worm-Ramen Worm;Worm-Ramen Worm执行动作;Worm-Ramen Worm执行动作;Worm-Ramen Worm传染阶段;Worm-Ramen Worm;Worm-Ramen Worm;主动响应（Active Response）：TCP RST packets ;主动响应Active Response： 《An Analysis of TCP Reset Behaviour on the Internet》 ;The measurement results in this paper focus on two traces. The first covers the year-long period spanning October 1, 2003 through September 30, 2004. This trace contains 26,839,809,058 packets, comprising 7,893,035,860 TCP connections. The second trace records all packets sent via the commercial Internet link between non-university clients and the campus Web server. There are 361,420 connections and 14,393,799 packets in this trace;主动响应Active Response： 《An Analysis of TCP Reset Behaviour on the Internet》;主动响应Active Response： 《An Analysis of TCP Reset Behaviour on the Internet》;主动响应Active Response： 《An Analysis of TCP Reset Behaviour on the Internet》结论： ;主动响应Active Response 《