sniffer使用教程

1、Sniffer 軟件使用介紹,,Sniffer介紹,與Netxray比較，Sniffer支持的協(xié)議更豐富，例如PPPOE協(xié)議等在Netxray并不支持，在Sniffer上能夠進行快速解碼分析 Netxray不能在Windows 2000和Windows XP上正常運行，Sniffer Pro 4.6可以運行在各種Windows平臺上。 Sniffer軟件比較大，運行時需要的計算機內(nèi)存比較大,功能介紹,捕獲網(wǎng)絡流量進行詳細分析 利用

2、專家分析系統(tǒng)診斷問題 實時監(jiān)控網(wǎng)絡活動 收集網(wǎng)絡利用率和錯誤等 在進行流量捕獲之前首先選擇網(wǎng)絡適配器，確定從計算機的哪個網(wǎng)絡適配器上接收數(shù)據(jù)。位置：File->select settings,,,,,,,Adapter,ToolsPingTrace RouteDNS LookupFingerWho Is,,,,,Trigger,Name Discovery,Alarms,Monitor Filters,,

3、Monitor ApplicationsDashboardHost TableMatrixARTHistory SamplesProtocol DistributionGlobal Statistics,,,Capture Filters,,,,Display Filters,Displays DecodeMatrixHost TableProtocol DistStatistics,,Probe Dir

4、ProfilesConfigsAddr BkDatabaseTracesExported Data,,Sniffer Portable Operation,,系統(tǒng)要求,Windows 98 SE, 2000, or NT 4.0Sniffer Portable Software (Provided by Network Associates)Microsoft Internet Explorer with MS V

5、irtual Machine and media playerPentium 400 MHz CPU with minimum 128 MB RAM (256 MB recommended) and minimum 125 MB free disk spaceNetwork Interface Card with NDIS 3.0+ driverEnhanced NAI drivers for selected cards enh

6、ance performance and allow error frames to be captured and analyzed,支持的接口類型,Ethernet 10/100Token Ring 4/16FDDIHSSIFull Duplex (supported with a pod) ATMWANGigabit Ethernet802.11b Wireless LAN,The OSI Model and Fr

7、ames,Frames include headers at several layers of the OSI model The number of headers in a frame is protocol-dependentEach header has multiple fields that are also protocol-dependent The Sniffer Network Analyzer reads

8、the entire frame and decodes each byte (and sometimes each bit) into an English explanation of the values,,DLC,,Application,,Presentation,,Session,,Transport,,Network,,LLC,,RI,啟用Sniffer,開啟 Sniffer,開啟 SNIFFER.EXE應用程序選擇[

9、File-- Select Settings... ]選擇想用的本地代理Adapters must be previously configured in Windows and use NAI enhanced or NDIS 3.0+ compliant drivers 應用程序自動開始通過活動的本地代理監(jiān)控流量,本地代理?,本地代理指一組設定、地址及與網(wǎng)卡相關的配置文件的邏輯概念在Sniffer 的程序目錄中，每個本地代理都

10、有唯一的目錄；所作的修改獎杯保存在活動本地代理的目錄中,Adapter,Local Agent 2ConfigurationsThresholdsAddress BookProfiles (Filters),Local Agent 1ConfigurationsThresholdsAddress BookProfiles (Filters),Select Settings...,The title bar indica

11、tes the active local agent,,,選擇網(wǎng)卡,設定對話框患有已設定的所有本地代理程序目錄下的“Local” 目錄有每個代理的設置信息,,用戶界面,,,,Status Bar,標題,主菜單,工具欄,捕獲工具圖標,,,工具欄,File Open,Save,AddressBook,Abort Print,Dashboard,Hosts,ApplicationResponseTime,Matrix,Histo

12、ry,ProtocolDistribution,GlobalStats,Alarms,CapturePanel,,Print,,,,,,,,,,,,,,使用包生成器,發(fā)包器?,發(fā)包器的主要目的是測試網(wǎng)絡性能你能配置:已捕獲被緩存的幀被顯示的幀新配置的幀無數(shù)據(jù)幀,環(huán)回模式,從緩存?zhèn)鬏攷?“replay” 的跟蹤文件有利于快速顯示監(jiān)控或捕獲數(shù)據(jù)WARNING:在發(fā)包前確保使能了環(huán)回模式,發(fā)包器,捕獲或顯示包跟蹤文件T

13、ools > Packet Generator,發(fā)送當前緩存,,,,重發(fā),停止,配置并發(fā)新包,,發(fā)送當前包,,,,,,發(fā)包器,Animation View—顯示數(shù)據(jù)被 “pumped” 到網(wǎng)絡中,Detail view—顯示統(tǒng)計數(shù)據(jù):,右下角的計數(shù)器:,從文件監(jiān)控并捕獲,現(xiàn)有網(wǎng)絡存在問題，為使能 Monitor，必須設置 local agent 為 Loopback Mode加載跟蹤文件從跟蹤文件產(chǎn)生流量監(jiān)控器將接收數(shù)據(jù)，

14、好像他們來自于網(wǎng)絡，并給我們統(tǒng)計信息,產(chǎn)生于文件,打開Files:選擇 Loopback Mode打開跟蹤文件幀將存儲在捕獲緩存中顯示數(shù)據(jù)Display the data打開 Tools: 選擇 Packet Generator選擇 Send Buffer圖標配置緩存發(fā)送次數(shù)注意右下角計數(shù)器,,緩存發(fā)包配置,配置發(fā)送頻率:,,監(jiān)控網(wǎng)絡性能,,監(jiān)控物件,顯示監(jiān)控數(shù)據(jù). 在Monitor 菜單下和主工具欄都有下7個物件:,

15、Dashboard,Host Table,Matrix,Protocol Distribution,History Samples,GlobalStatistics,,,,,,,,,Application ResponseTime,,,The Dashboard,Sniffer 啟動后馬上開始收集網(wǎng)絡段的數(shù)據(jù)要實時瀏覽網(wǎng)絡數(shù)據(jù), 從Monitor菜單選擇 Dashboard需通過診斷等工具察看紅色區(qū)域。,紅色區(qū)域位域值,,

16、,,,每秒的錯誤數(shù),利用百分比,每秒包,,,,,,Host Table,提供收集到的每個節(jié)點流量數(shù)據(jù)的實時快速分析有四種瀏覽模式:Outline table Detail table Bar chartPie chart,,Host Table - Toolbar,Display stats for selected station,Export data to spreadsheet(table views only),R

17、efresh display,Define filter,Pie chart view,Detail table view,Bar chart view,Capture data,Pause screen updates,Restart data collection,Properties,Outline table view,,,,,,,,,,,,,Host Table - Outline Table View,The outline

18、 table 提供每個節(jié)點輸入輸出總字節(jié)數(shù)的概要:,,,Host Table - Detail Table View,The detail table 提供每個節(jié)點高層協(xié)議類型和輸入輸出流量的概要:,,,Host Table - Bar Chart View,柱狀圖實時顯示最忙的前N名節(jié)點,,Host Table - Pie Chart View,餅狀圖顯示最前N名忙的節(jié)點，即其相關百分比,,Host Table數(shù)據(jù)的應用,獲得單個站點

19、的數(shù)據(jù)了解那個站點應用了特殊協(xié)議掌握高流量站點快速定位發(fā)送廣播的站點設定懷疑地址，過濾為基礎分析輸出歷史數(shù)據(jù),Matrix - Traffic Map,The Matrix實時收及網(wǎng)絡節(jié)點間的回話數(shù)據(jù)以流量圖方式流覽Matrix,或以柱狀或餅狀圖,,,Matrix的應用,用不同的瀏覽方式快速定位通信雙方找出配錯的路由器，他讓本應過濾的幀通過找出通過防火墻的幀看連接的數(shù)據(jù)設置節(jié)點地址過濾,Application Res

20、ponse Time,測試服務器/客戶端應用程序協(xié)議響應時間 Table View:,,,,History Samples,用 History Samples 來收集不同時段的不同網(wǎng)絡數(shù)據(jù)，從而建立網(wǎng)絡性能的基準基準數(shù)據(jù)有助于設定有非正常網(wǎng)絡事件發(fā)生時的高警域值也可用來導出長期的網(wǎng)絡趨勢，有利于將來網(wǎng)絡的擴展和改造計劃,,Protocol Distribution,用Protocol Distribution 提供網(wǎng)絡基

21、于network-, transport-, 和application層的網(wǎng)絡應用監(jiān)控 IPX/SPX, TCP/IP, NetBIOS,AppleTalk, DECnet,SNA, Banyan, andother protocols,,Global Statistics,Global Statistics 有助于理解網(wǎng)絡中的所有活動指標Pinpoint large andsmall size packettraff

22、ic loads,,Use tabs to select frame size or Util. %,,保存監(jiān)控數(shù)據(jù),選擇Database/Options… 來保存監(jiān)控或?qū)＜覕?shù)據(jù)到一 CSV文件,,捕獲網(wǎng)絡流量,,捕獲環(huán)境,緩存大小捕獲緩存缺省設為8M可通過選擇 Capture菜單,再選擇 Define Filter然后選擇 Buffer萊修改物理位置Sniffer的物理連接方式?jīng)Q定了所能捕獲的數(shù)據(jù)量 Capture Fi

23、ltersCapture Filters 提供選擇標準，那種類型的幀能被捕獲進入緩存,Capture Controls,用工具欄中的 capture按鈕:,,實時分析,捕獲一開始，, Sniffer 就開始分類并分析進入的數(shù)據(jù)，執(zhí)行實時專家分析,設置捕獲緩存選項,點擊工具欄的 Define Capture Filter 圖標 選擇Buffer Buffer SizePacket SizeStop or wrapSave t

24、o File,,Expert Window: Default View,,Expert Summary,Select object type for summary,Expert Overview,Expand to Detail View Tab,,,,,Expert Window: Overview,,Click on number to view summary data,Protocol Statistics,,Expert O

25、verview,,Expert Window:Station Layer Object Detail,,Related Addresses,Double-click to view object detail,,Addressing Details,Alarms,,,Object Detail,,Analyzing Network Issues,,顯示捕獲數(shù)據(jù),能顯示和分析存儲的幀代碼:捕獲的幀OR開啟捕獲的文件,,,S

26、top and display capture,Post-Analysis Tabs,,定義過濾器,Displays the current capture filter,,,Select a previously defined capture filter,,,,為捕獲過程定義過濾器從下拉菜單OR從工具欄,應用過濾配置文件,創(chuàng)建捕獲過濾配置文件:1. 點擊工具欄的 Define Filtericon2.點擊Profil

27、es… 按鈕3.點擊New…按鈕4.為過濾器指定一個名字5. 復制一個現(xiàn)存的或模板配置文件6.點擊OK and Done7. 指定過濾器的參數(shù)8. 需要時從列表中選擇過濾器,,Previously defined profiles,Click here to create, edit, or delete a profile,,通過地址過濾,用 Address 設定過濾器來捕獲數(shù)據(jù)鏈路或網(wǎng)絡地址節(jié)點間的包,Known Add

28、resses,,Direction of Communication,,Specify upto 10 address pairs,Mode,Address Type,,,,通過數(shù)據(jù)模板過濾,用 Data Pattern 來定義過濾器，這將只捕獲符合指定數(shù)據(jù)模板的數(shù)據(jù)包,高級列表,用 Advanced設定來定義過濾器，通過協(xié)議類型、包大小及包類型來過濾,Packet Type,,Packet Size,,Protocol Type,,