sniffer使用教程

1、Sniffer 軟件使用介紹,,Sniffer介紹,與Netxray比較，Sniffer支持的協(xié)議更豐富，例如PPPOE協(xié)議等在Netxray并不支持，在Sniffer上能夠進(jìn)行快速解碼分析 Netxray不能在Windows 2000和Windows XP上正常運(yùn)行，Sniffer Pro 4.6可以運(yùn)行在各種Windows平臺(tái)上。 Sniffer軟件比較大，運(yùn)行時(shí)需要的計(jì)算機(jī)內(nèi)存比較大,功能介紹,捕獲網(wǎng)絡(luò)流量進(jìn)行詳細(xì)分析 利用

2、專家分析系統(tǒng)診斷問題 實(shí)時(shí)監(jiān)控網(wǎng)絡(luò)活動(dòng) 收集網(wǎng)絡(luò)利用率和錯(cuò)誤等 在進(jìn)行流量捕獲之前首先選擇網(wǎng)絡(luò)適配器，確定從計(jì)算機(jī)的哪個(gè)網(wǎng)絡(luò)適配器上接收數(shù)據(jù)。位置：File->select settings,,,,,,,Adapter,ToolsPingTrace RouteDNS LookupFingerWho Is,,,,,Trigger,Name Discovery,Alarms,Monitor Filters,,

3、Monitor ApplicationsDashboardHost TableMatrixARTHistory SamplesProtocol DistributionGlobal Statistics,,,Capture Filters,,,,Display Filters,Displays DecodeMatrixHost TableProtocol DistStatistics,,Probe Dir

4、ProfilesConfigsAddr BkDatabaseTracesExported Data,,Sniffer Portable Operation,,系統(tǒng)要求,Windows 98 SE, 2000, or NT 4.0Sniffer Portable Software (Provided by Network Associates)Microsoft Internet Explorer with MS V

5、irtual Machine and media playerPentium 400 MHz CPU with minimum 128 MB RAM (256 MB recommended) and minimum 125 MB free disk spaceNetwork Interface Card with NDIS 3.0+ driverEnhanced NAI drivers for selected cards enh

6、ance performance and allow error frames to be captured and analyzed,支持的接口類型,Ethernet 10/100Token Ring 4/16FDDIHSSIFull Duplex (supported with a pod) ATMWANGigabit Ethernet802.11b Wireless LAN,The OSI Model and Fr

7、ames,Frames include headers at several layers of the OSI model The number of headers in a frame is protocol-dependentEach header has multiple fields that are also protocol-dependent The Sniffer Network Analyzer reads

8、the entire frame and decodes each byte (and sometimes each bit) into an English explanation of the values,,DLC,,Application,,Presentation,,Session,,Transport,,Network,,LLC,,RI,啟用Sniffer,開啟 Sniffer,開啟 SNIFFER.EXE應(yīng)用程序選擇[

9、File-- Select Settings... ]選擇想用的本地代理Adapters must be previously configured in Windows and use NAI enhanced or NDIS 3.0+ compliant drivers 應(yīng)用程序自動(dòng)開始通過活動(dòng)的本地代理監(jiān)控流量,本地代理?,本地代理指一組設(shè)定、地址及與網(wǎng)卡相關(guān)的配置文件的邏輯概念在Sniffer 的程序目錄中，每個(gè)本地代理都

10、有唯一的目錄；所作的修改獎(jiǎng)杯保存在活動(dòng)本地代理的目錄中,Adapter,Local Agent 2ConfigurationsThresholdsAddress BookProfiles (Filters),Local Agent 1ConfigurationsThresholdsAddress BookProfiles (Filters),Select Settings...,The title bar indica

11、tes the active local agent,,,選擇網(wǎng)卡,設(shè)定對(duì)話框患有已設(shè)定的所有本地代理程序目錄下的“Local” 目錄有每個(gè)代理的設(shè)置信息,,用戶界面,,,,Status Bar,標(biāo)題,主菜單,工具欄,捕獲工具圖標(biāo),,,工具欄,File Open,Save,AddressBook,Abort Print,Dashboard,Hosts,ApplicationResponseTime,Matrix,Histo

12、ry,ProtocolDistribution,GlobalStats,Alarms,CapturePanel,,Print,,,,,,,,,,,,,,使用包生成器,發(fā)包器?,發(fā)包器的主要目的是測(cè)試網(wǎng)絡(luò)性能你能配置:已捕獲被緩存的幀被顯示的幀新配置的幀無(wú)數(shù)據(jù)幀,環(huán)回模式,從緩存?zhèn)鬏攷?“replay” 的跟蹤文件有利于快速顯示監(jiān)控或捕獲數(shù)據(jù)WARNING:在發(fā)包前確保使能了環(huán)回模式,發(fā)包器,捕獲或顯示包跟蹤文件T

13、ools > Packet Generator,發(fā)送當(dāng)前緩存,,,,重發(fā),停止,配置并發(fā)新包,,發(fā)送當(dāng)前包,,,,,,發(fā)包器,Animation View—顯示數(shù)據(jù)被 “pumped” 到網(wǎng)絡(luò)中,Detail view—顯示統(tǒng)計(jì)數(shù)據(jù):,右下角的計(jì)數(shù)器:,從文件監(jiān)控并捕獲,現(xiàn)有網(wǎng)絡(luò)存在問題，為使能 Monitor，必須設(shè)置 local agent 為 Loopback Mode加載跟蹤文件從跟蹤文件產(chǎn)生流量監(jiān)控器將接收數(shù)據(jù)，

14、好像他們來自于網(wǎng)絡(luò)，并給我們統(tǒng)計(jì)信息,產(chǎn)生于文件,打開Files:選擇 Loopback Mode打開跟蹤文件幀將存儲(chǔ)在捕獲緩存中顯示數(shù)據(jù)Display the data打開 Tools: 選擇 Packet Generator選擇 Send Buffer圖標(biāo)配置緩存發(fā)送次數(shù)注意右下角計(jì)數(shù)器,,緩存發(fā)包配置,配置發(fā)送頻率:,,監(jiān)控網(wǎng)絡(luò)性能,,監(jiān)控物件,顯示監(jiān)控?cái)?shù)據(jù). 在Monitor 菜單下和主工具欄都有下7個(gè)物件:,

15、Dashboard,Host Table,Matrix,Protocol Distribution,History Samples,GlobalStatistics,,,,,,,,,Application ResponseTime,,,The Dashboard,Sniffer 啟動(dòng)后馬上開始收集網(wǎng)絡(luò)段的數(shù)據(jù)要實(shí)時(shí)瀏覽網(wǎng)絡(luò)數(shù)據(jù), 從Monitor菜單選擇 Dashboard需通過診斷等工具察看紅色區(qū)域。,紅色區(qū)域位域值,,

16、,,,每秒的錯(cuò)誤數(shù),利用百分比,每秒包,,,,,,Host Table,提供收集到的每個(gè)節(jié)點(diǎn)流量數(shù)據(jù)的實(shí)時(shí)快速分析有四種瀏覽模式:Outline table Detail table Bar chartPie chart,,Host Table - Toolbar,Display stats for selected station,Export data to spreadsheet(table views only),R

17、efresh display,Define filter,Pie chart view,Detail table view,Bar chart view,Capture data,Pause screen updates,Restart data collection,Properties,Outline table view,,,,,,,,,,,,,Host Table - Outline Table View,The outline

18、 table 提供每個(gè)節(jié)點(diǎn)輸入輸出總字節(jié)數(shù)的概要:,,,Host Table - Detail Table View,The detail table 提供每個(gè)節(jié)點(diǎn)高層協(xié)議類型和輸入輸出流量的概要:,,,Host Table - Bar Chart View,柱狀圖實(shí)時(shí)顯示最忙的前N名節(jié)點(diǎn),,Host Table - Pie Chart View,餅狀圖顯示最前N名忙的節(jié)點(diǎn)，即其相關(guān)百分比,,Host Table數(shù)據(jù)的應(yīng)用,獲得單個(gè)站點(diǎn)

19、的數(shù)據(jù)了解那個(gè)站點(diǎn)應(yīng)用了特殊協(xié)議掌握高流量站點(diǎn)快速定位發(fā)送廣播的站點(diǎn)設(shè)定懷疑地址，過濾為基礎(chǔ)分析輸出歷史數(shù)據(jù),Matrix - Traffic Map,The Matrix實(shí)時(shí)收及網(wǎng)絡(luò)節(jié)點(diǎn)間的回話數(shù)據(jù)以流量圖方式流覽Matrix,或以柱狀或餅狀圖,,,Matrix的應(yīng)用,用不同的瀏覽方式快速定位通信雙方找出配錯(cuò)的路由器，他讓本應(yīng)過濾的幀通過找出通過防火墻的幀看連接的數(shù)據(jù)設(shè)置節(jié)點(diǎn)地址過濾,Application Res

20、ponse Time,測(cè)試服務(wù)器/客戶端應(yīng)用程序協(xié)議響應(yīng)時(shí)間 Table View:,,,,History Samples,用 History Samples 來收集不同時(shí)段的不同網(wǎng)絡(luò)數(shù)據(jù)，從而建立網(wǎng)絡(luò)性能的基準(zhǔn)基準(zhǔn)數(shù)據(jù)有助于設(shè)定有非正常網(wǎng)絡(luò)事件發(fā)生時(shí)的高警域值也可用來導(dǎo)出長(zhǎng)期的網(wǎng)絡(luò)趨勢(shì)，有利于將來網(wǎng)絡(luò)的擴(kuò)展和改造計(jì)劃,,Protocol Distribution,用Protocol Distribution 提供網(wǎng)絡(luò)基

21、于network-, transport-, 和application層的網(wǎng)絡(luò)應(yīng)用監(jiān)控 IPX/SPX, TCP/IP, NetBIOS,AppleTalk, DECnet,SNA, Banyan, andother protocols,,Global Statistics,Global Statistics 有助于理解網(wǎng)絡(luò)中的所有活動(dòng)指標(biāo)Pinpoint large andsmall size packettraff

22、ic loads,,Use tabs to select frame size or Util. %,,保存監(jiān)控?cái)?shù)據(jù),選擇Database/Options… 來保存監(jiān)控或?qū)＜覕?shù)據(jù)到一 CSV文件,,捕獲網(wǎng)絡(luò)流量,,捕獲環(huán)境,緩存大小捕獲緩存缺省設(shè)為8M可通過選擇 Capture菜單,再選擇 Define Filter然后選擇 Buffer萊修改物理位置Sniffer的物理連接方式?jīng)Q定了所能捕獲的數(shù)據(jù)量 Capture Fi

23、ltersCapture Filters 提供選擇標(biāo)準(zhǔn)，那種類型的幀能被捕獲進(jìn)入緩存,Capture Controls,用工具欄中的 capture按鈕:,,實(shí)時(shí)分析,捕獲一開始，, Sniffer 就開始分類并分析進(jìn)入的數(shù)據(jù)，執(zhí)行實(shí)時(shí)專家分析,設(shè)置捕獲緩存選項(xiàng),點(diǎn)擊工具欄的 Define Capture Filter 圖標(biāo) 選擇Buffer Buffer SizePacket SizeStop or wrapSave t

24、o File,,Expert Window: Default View,,Expert Summary,Select object type for summary,Expert Overview,Expand to Detail View Tab,,,,,Expert Window: Overview,,Click on number to view summary data,Protocol Statistics,,Expert O

25、verview,,Expert Window:Station Layer Object Detail,,Related Addresses,Double-click to view object detail,,Addressing Details,Alarms,,,Object Detail,,Analyzing Network Issues,,顯示捕獲數(shù)據(jù),能顯示和分析存儲(chǔ)的幀代碼:捕獲的幀OR開啟捕獲的文件,,,S

26、top and display capture,Post-Analysis Tabs,,定義過濾器,Displays the current capture filter,,,Select a previously defined capture filter,,,,為捕獲過程定義過濾器從下拉菜單OR從工具欄,應(yīng)用過濾配置文件,創(chuàng)建捕獲過濾配置文件:1. 點(diǎn)擊工具欄的 Define Filtericon2.點(diǎn)擊Profil

27、es… 按鈕3.點(diǎn)擊New…按鈕4.為過濾器指定一個(gè)名字5. 復(fù)制一個(gè)現(xiàn)存的或模板配置文件6.點(diǎn)擊OK and Done7. 指定過濾器的參數(shù)8. 需要時(shí)從列表中選擇過濾器,,Previously defined profiles,Click here to create, edit, or delete a profile,,通過地址過濾,用 Address 設(shè)定過濾器來捕獲數(shù)據(jù)鏈路或網(wǎng)絡(luò)地址節(jié)點(diǎn)間的包,Known Add

28、resses,,Direction of Communication,,Specify upto 10 address pairs,Mode,Address Type,,,,通過數(shù)據(jù)模板過濾,用 Data Pattern 來定義過濾器，這將只捕獲符合指定數(shù)據(jù)模板的數(shù)據(jù)包,高級(jí)列表,用 Advanced設(shè)定來定義過濾器，通過協(xié)議類型、包大小及包類型來過濾,Packet Type,,Packet Size,,Protocol Type,,