Wireshark可以用来改变数据包的内容吗
Wireshark似乎无法实时更改过滤数据包的内容。
有谁知道类似的软件可以更改被过滤的数据包内容。
找到这样的东西真的会救你一命，
谢谢。
Wireshark doesn't seem to be able to change the content of filtered packets in real time.
Does anyone know a symilar software which can change packet content that is filtered.
Finding something like this will really be a life saver
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
至少在 Unices 等使用原始套接字的地方，这是不可能的，因为数据包被复制到用户空间，而您只能处理该副本。此外，通过原始套接字发送回数据包可以被视为“传出”数据包，因此实际上它不会被重新注入到它应该在的输入路径。根据 Linux 手册页，原始套接字旨在实现新协议，IOW，原始套接字是“端点”，而不是“直通站”。
对于输入路径中的数据包修改（类似直通），每个操作系统都有自己的一组接口。在 Linux 中（您不太明确您的目标），这将是 nfqueue 机制，可通过 libnetfilter_queue 使用。当然，如果wireshark愿意的话（我上次检查时没有看到它进行数据包更改），它就会这样做。
At least on Unices and -like where raw sockets are used, this is not possible, since the packet is copied to userspace and you only work on that copy. Furthermore, sending a packet back through the raw socket may be considered an "outgoing" packet so that it is, in fact, not reinjected to the input path where it should be. Raw sockets were — according to the Linux manpage — designed to implement new protocols, IOW, raw sockets are an "endpoint", not a "passthrough station".
For packet modification in the input path (passthrough-like), each OS has its own set of interfaces. In Linux (you were sort of unspecific as to which you target), that would be the nfqueue mechanism, usable through libnetfilter_queue. And of course, that is how wireshark, if it wanted to (I don't see it doing packet alteration last time I checked), would go about doing this.
请尝试Burp Suite。它包括一个中继器，可让您修改 HTTP 请求。
Please give Burp Suite a try. It includes a repeater that let's you modify HTTP requests.
没有wireshark 不会让您更改数据包的内容并将它们放回到线路上。然而，有一些方法可以在数据包通过机器时对其进行更改。通常，主机设置有两个桥接在一起的网卡。一个网卡连接到一个网络，另一个网卡连接到另一个网络。然后，当数据包通过此点时，主机可以看到它们。现在您可以使用 iptables/netfilter 并编写一个更改数据包中数据的模块。例如，您可以编写一些可以重新映射源 IP 地址的内容。我已经有一段时间没有使用 netfilter/iptables 了，所以我无法提供更多细节，但我在之前的工作中使用过它，在数据包飞行时对它们进行一些巧妙的处理。但这确实意味着您需要一台位于网络连接点的主机。
No wireshark won't let you change the contents of the packets and place them back on the line. However there are ways to change packets as they pass through the machine. Typically the host is setup with two nics bridged together. One nic is connected to one network and the other nic to the other network. Then as packets pass through this point the host can see them. Now you can use iptables/netfilter and write a module that changes data in the packet. For example you can write something that can remap source ip addresses. It's been a while since I've used netfilter/iptables, so I can't provide anymore details, but I have used it in a previous job to do some neat things with packets while they were inflight. It does mean you need a host machine sitting at network junction points though.
该文档表明 node.get("nextSibling") 和 node.get("previousSibling") 就是您所需要的。
The documentation suggests that node.get("nextSibling") and node.get("previousSibling") are what you need.
是的，可以。
在构建之前，您需要将此选项传递给配置脚本：
--启用数据包编辑器
Yes, it can.
You need to pass this option to the configure script before you build it:
--enable-packet-editor