解密编码：数据包分析工具
我正在为此寻找比 Wireshark 更好的工具。 Wireshark 的问题在于，它没有清晰地格式化数据层（这是我正在查看的唯一部分），以便我比较不同的数据包并尝试理解第三方编码（这是闭源的）。
具体来说，有哪些用于查看数据而不是 TCP/UDP 标头信息的好工具？ 特别是格式化数据以进行比较的工具。
非常具体：我想要一个可以比较多个（不仅仅是 2 个）十六进制文件的程序。
I am looking for better tools than Wireshark for this. The problem with Wireshark is that it does not format the data layer (which is the only part I am looking at) cleanly for me to compare the different packets and attempt to understand the third party encoding (which is closed source).
Specifically, what are some good tools for viewing data, and not TCP/UDP header information? Particularly, a tool that formats the data for comparison.
To be very specific: I would like a program that compares multiple (not just 2) files in hex.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
请查看来自 BreakingPoint Labs 的这篇博文。 他们正在讨论手动协议逆向工程和一组基于 PacketFu 构建的工具来完成此任务更轻松。
与您的问题相关的是一组工具，可以轻松识别和突出显示数据包的更改。 下面是一个示例屏幕截图，显示了使用颜色来概述数据包差异的情况：
（来源：breakpointsystems.com）
Take a look at this blog post from BreakingPoint Labs. They are discussing manual protocol reverse engineering and a set of tools built on PacketFu to make this task easier.
Relevant to your question is the set of tools that makes it easy to identify and highlight changes to packets. Here's an example screenshot that shows the use of color to outline the packet differences:
(source: breakingpointsystems.com)
坦率地说，你最好的选择就是自己推出。
获取一种您熟悉的脚本语言并开始解决问题。 首先编写一个简单的多路比较，但是一旦您开始找到您认为重要（或您认为可能重要）的模式，请返回并将它们添加到代码中 - 从输出中消除它们，突出显示它们，翻译它们将它们替换为另一种符号，用它们的“含义”或它们的角色的一些高级描述来替换它们——无论什么看起来合适。 如果你无法决定，就让它成为一个选择。
您之所以需要可视化软件，是因为您想要一些东西来帮助您形成并内化对其编码的理解。 但是您要做的比较只是您将使用的过程的一部分（本质上是科学方法）——您还将形成和修改对数据包各个部分的含义以及它们如何相互作用的猜测 没有任何
预先构建的工具可以为您提供帮助，但是良好的脚本语言（例如 python、ruby，甚至 perl）将会有很大帮助。 当你形成一个理论时，将其编码并进行尝试。 混杂你的代码，尝试你想到的不同想法，在你进行过程中构建针对这个问题定制的一系列技巧。
——马库斯
Q 不要陷入尝试使用 C 或 Java 或其他东西来执行此操作的陷阱。 您将玩得又快又松，并且应该拥有一个不需要变量声明、编译等的工具。一旦您了解了它的工作原理，就有很多机会收紧它并重写它。 /em>
Your best bet, frankly, is to roll your own.
Get a scripting language that you're comfortable with and start hacking away at the problem. First write up a simple multiway comparison, but as soon as you start finding patterns that you think are significant (or that you think might be) go back and add them to the code--eliminate them from the output, highlight them, translate them into another notation, replace them with their "meaning" or some high level description of their role--whatever seems appropriate. If you can't decide, make it an option.
You are asking for visualization software because you want something to help you form and internalize an understanding of their encoding. But the comparisons you are going to make are only part of the process you'll be using (which is essentially the scientific method)--you'll also be forming and revising guesses about what various parts of the packets mean, how they interact, etc.
No pre-built tool is going to help you there, but a good scripting language (say python, ruby, or even perl) will help a lot. As you form a theory, code it up and try it out. Mungle your code around, trying out different ideas as they occur to you, building up a bag of tricks customized to this problem as you go along.
-- MarkusQ
P.S. Don't fall into the trap of trying to use C or Java or something to do this. You'll be playing fast and loose, and should have a tool that doesn't require variable declarations, compilation, etc. There will be plenty of opportunity to tighten it up and rewrite it once you understand how it works.
您的问题不是分析网络数据，而是根据您的需求描述比较二进制文件。
我将通过任何嗅探器提取应用程序数据，即通过 Zoreadche 或 Wireshark 所描述的 tcpdump（即通过跟踪 TCP 会话）。 然后将其保存到文件中并通过任何文件比较工具进行比较。 您可以尝试这些（最流行的）：
Your problem is not to analyze network data, but compare binary files as you describe by your needs.
I would extract application data by means of any sniffer, i.e. by means of tcpdump used as described by Zoreadche, or Wireshark (i.e. by means of follow TCP session). Then save it to files and compare by any file comparation tool. You can try these (the most popular):
仅对于 HTTP，我曾经使用过一个名为 Effetech 的出色工具。
（虽然现在看来他们支持的不仅仅是HTTP......）
For HTTP only, I used to used a great tool called Effetech.
(though looking at it now it seems they support more than just HTTP....)
问题是应用层的数据不标准（极少数例外，如HTTP、POP3等）。 如果 Wireshark 等工具不知道格式，则无法解码此信息。
我知道一些旧版本的 Ethereal（现在是 Wireshark）可以选择（您可能必须启用它）来显示有效负载。 期望它没有意义，大多数协议都是二进制的！
The problem is that data at the application layer is not standard (with very few exceptions, like HTTP, POP3 and so). Tools like Wireshark can't decode this info if they don't know the format.
I know some old versions of Ethereal (now Wireshark) had the option (you might have to enable it) to show the payload. Expect it to not make sense, most protocols are in binary!
如果您使用 ethereal 进行了捕获，则可以读取该捕获，或者可以使用 tcpdump 进行捕获。 要捕获，请使用 tcpdump 命令，例如 tcpdump -s 0 -qn -X ，或 tcpdump -X -r filename 将读取捕获。
或者还有另一个 tcpick 可能就是您想要的。 您可以捕获 TCP 连接的有效负载，并将其显示为十六进制或保存。
If you have a capture you have done with ethereal you could read the capture, or you could do your captures with tcpdump. To capture use a tcpdump command like tcpdump -s 0 -qn -X , or tcpdump -X -r filename will read a capture.
Or there is another tcpick that may be what you want. You can capture the payload of tcp connections, and have it displayed as hex or saved.