用于 Windows 的 tcpflow

发布于 2024-08-21 00:40:18 字数 1459 浏览 9 评论 0原文

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(2

飘落散花 2024-08-28 00:40:18

您可以始终使用 Wireshark(或命令行中的 tshark.exe)来捕获数据,然后对它们进行后处理,而不考虑标头。

示例输出:

C:\Program Files\Wireshark>tshark.exe -x
Capturing on Intel(R) PRO/Wireless 3945ABG Network Connection (Microsoft's Packe
t Scheduler)

   0.000000 192.168.0.133 -> 192.168.0.255 SMB Mailslot Write Mail Slot

0000  ff ff ff ff ff ff 00 0e 2e 2b 35 55 08 00 45 00   .........+5U..E.  
0010  00 ce 5f 6e 00 00 80 11 57 dc c0 a8 00 85 c0 a8   .._n....W.......  
0020  00 ff 00 8a 00 8a 00 ba 95 f3 11 02 a3 0a c0 a8   ................  
0030  00 85 00 8a 00 a4 00 00 20 45 43 45 4a 46 45 45   ........ ECEJFEE  
0040  4d 45 4a 46 44 46 4b 43 41 43 41 43 41 43 41 43   MEJFDFKCACACACAC  
0050  41 43 41 43 41 43 41 41 41 00 20 45 4e 46 44 45   ACACACAAA. ENFDE  
0060  49 45 50 45 4e 45 46 43 41 43 41 43 41 43 41 43   IEPENEFCACACACAC  
0070  41 43 41 43 41 43 41 43 41 41 41 00 ff 53 4d 42   ACACACACAAA..SMB  
0080  25 00 00 00 00 18 04 00 00 00 00 00 00 00 00 00   %...............  
0090  00 00 00 00 00 00 ff fe 00 00 00 00 11 00 00 04   ................  
00a0  00 02 00 00 00 00 00 02 00 00 00 00 00 00 00 00   ................  
00b0  00 5c 00 04 00 5c 00 03 00 01 00 00 00 02 00 1b   .\...\..........  
00c0  00 5c 4d 41 49 4c 53 4c 4f 54 5c 54 57 42 5f 4d   .\MAILSLOT\TWB_M  
00d0  41 49 4c 53 4c 4f 54 00 29 7a 70 4b               AILSLOT.)zpK  

更新:

如果您需要在本地计算机(环回设备)上捕获数据包,您应该使用优秀的RawCap工具捕获pcap文件,然后使用Wireshark像往常一样在捕获的文件上。

You may always use Wireshark (or tshark.exe from the command line) to capture data and then post-process them afterwards without considering the headers.

Sample output:

C:\Program Files\Wireshark>tshark.exe -x
Capturing on Intel(R) PRO/Wireless 3945ABG Network Connection (Microsoft's Packe
t Scheduler)

   0.000000 192.168.0.133 -> 192.168.0.255 SMB Mailslot Write Mail Slot

0000  ff ff ff ff ff ff 00 0e 2e 2b 35 55 08 00 45 00   .........+5U..E.  
0010  00 ce 5f 6e 00 00 80 11 57 dc c0 a8 00 85 c0 a8   .._n....W.......  
0020  00 ff 00 8a 00 8a 00 ba 95 f3 11 02 a3 0a c0 a8   ................  
0030  00 85 00 8a 00 a4 00 00 20 45 43 45 4a 46 45 45   ........ ECEJFEE  
0040  4d 45 4a 46 44 46 4b 43 41 43 41 43 41 43 41 43   MEJFDFKCACACACAC  
0050  41 43 41 43 41 43 41 41 41 00 20 45 4e 46 44 45   ACACACAAA. ENFDE  
0060  49 45 50 45 4e 45 46 43 41 43 41 43 41 43 41 43   IEPENEFCACACACAC  
0070  41 43 41 43 41 43 41 43 41 41 41 00 ff 53 4d 42   ACACACACAAA..SMB  
0080  25 00 00 00 00 18 04 00 00 00 00 00 00 00 00 00   %...............  
0090  00 00 00 00 00 00 ff fe 00 00 00 00 11 00 00 04   ................  
00a0  00 02 00 00 00 00 00 02 00 00 00 00 00 00 00 00   ................  
00b0  00 5c 00 04 00 5c 00 03 00 01 00 00 00 02 00 1b   .\...\..........  
00c0  00 5c 4d 41 49 4c 53 4c 4f 54 5c 54 57 42 5f 4d   .\MAILSLOT\TWB_M  
00d0  41 49 4c 53 4c 4f 54 00 29 7a 70 4b               AILSLOT.)zpK  

Update:

If you need to capture packets on the local machine (loopback device), you should use the excellent RawCap tool to capture a pcap file, then use Wireshark on the captured file as usual.

酒绊 2024-08-28 00:40:18

这里是一个适用于 Windows 的工具,与tcpflow 尽可能。 :-)

也就是说,它是 tcpflow,为 Windows 编译的。我还没有尝试过,但我认为它有效。它是一个“zipball”,因此您需要一些可以从 Zip 存档中提取的软件。

Here is a tool for Windows that's about as much like tcpflow as possible. :-)

I.e., it IS tcpflow, compiled for Windows. I haven't tried it, but I assume it works. It's a "zipball", so you'll need some software that can extract from a Zip archive.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文