wireshark捕获文件详细信息，如何查找使用的工具
我有一个捕获文件，我想找到它的某些详细信息，我使用wireshark打开这个捕获文件，我试图弄清楚如何找到攻击者使用的工具的名称。我可以从这个捕获文件中寻找任何迹象或东西来让我知道。
I have a capture file that i want to find certain details about, i used wireshark to open this capture file and im trying to figure how to find the name of the tool the attacker used. is there any indications or things i could look for from this capture file that lets me know.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
通过使用wireshark，您可以了解更多关于他们攻击您的方法（即ping洪水或生成树攻击）与使用cain或某些安全套件等程序的情况。如果您想找到该工具，我建议您找到一个工具并测试您认为他们使用的攻击，并比较数据包流量。
With wireshark you learn more about the method by which they attacked you (ie ping flooding or spanning tree attacks) vs using a program like cain or some Security Suite. If you want to find the tool, I suggest find a tool and testing the attack that you think they used, and compare packet traffic.
使用 Snort 来分析数据包捕获文件可能会有更好的运气。除了嗅探工具之外，它还提供入侵检测和签名分析，并且更适合您正在寻找的分析类型，而 Wireshark 主要是一个（非常好的）纯网络嗅探器。
我没有以这种身份使用它（仅作为嗅探器），但我知道它允许您分析过去的捕获，并且从刚才重新浏览文档来看，它看起来很可能会做您想做的事情。
是否能够识别真正的 0-day 漏洞是另一回事，这取决于他们更新/发布签名的速度，但大多数脚本小子无论如何都不使用 0-day。
预计到达时间：现在看来他们需要一个帐户，但至少对于普通帐户来说，它们似乎是免费的。他们似乎还提供订阅服务，但希望注册用户签名文件足够新以识别攻击。
You may have better luck using Snort to analyze the packet capture file. In addition to a sniffing tool, it provides intrusion detection and signature analysis, and is more geared toward the type of analysis you're looking for, whereas Wireshark is primarily a (very good) pure network sniffer.
I haven't used it in this capacity (only as a sniffer), but I know it allows you to analyze past captures, and from re-skimming the docs just now, it looks like it will likely do what you want to do.
Whether it can identify real 0-day exploits is another matter, that's dependent upon how quickly they update/release their signatures, but most script kiddies don't use 0-day anyway.
ETA: It looks like they require an account nowadays, but it also appears that, at least for the normal accounts, they're free. They also seem to offer a subscription service, but the registered user signature files are hopefully current enough to identify the attack.