=== ch08.docx
[chap]8́@{IȌẼViI

̏͂́AWiresharkgČ̃lbg[Ngu𕪐͂钆ŁApPbg̖͂{@艺Ă܂B1ł̓lbg[NGWjAAwvfXNSҁA邢̓AvP[VJ҂ƂēXʂViI𕪐͂܂B͂M҂⓯̎̌ɂ̂łBWiresharkgāATwitterAFacebookAESPN.com̃gtBbN𒲂ׁA悭gT[rXǂ̂悤ɋ@\Ă邩Ă܂B
2ł́AɋNguグ܂Bꂼ̃gu芪󋵂ƂƂɁA̎_ŃpPbg͎҂肵Ă񋟂܂BׂsApPbg͂ɈڂAK؂ȃpPbgLv`邽߂̎@A͍ƂiK𓥂Ő܂BpPbg͂Agủ@A邢͉̎񎦂āAŊw񂾂Ƃ̊Tv܂B
pPbg͔͂ɗՋ@ςȍƂłBꂼ̃ViỈ͂ɗp@́Aǎ҂̎@Ƃ͈قȂ邩m܂B͎@͐lꂼłBԑ؂Ȃ̂́A͂̌ʃguǍowKłƂƂȂ̂łB܂{͂Őgȗ唼́ApPbgXjbt@g킸ɉł邩m܂BApPbg͂̎@ɏ߂ĐڂƂɁApPbg͂pĕʂ̎_炠肪ȃguɎgނƂɖ𗧂ƂɋCÂAViI񎦂Ă܂B

pPbgxłSNS̕
܂2̐lCSNSTCgATwitterFacebook̃gtBbNĂ݂܂傤BeT[rX̔F؏𒲂ׁA҂̔ɂ悭@\AقȂ@gē@\ĂlqĂ܂B܂ꂼ̃T[rX̎vȋ@\̓ĂƂŁAX̊ŔgtBbNւ̗[߂Ă܂傤B

TwittergtBbÑLv`
ZpR~jeB̍ŐVj[X𒀎肷Ƃޏ̋sڂƂ܂ŁATwitter̓C^[lbgłƂ悭pĂT[rX̂ЂƂłBt@Ctwitter_login.pcapɁATwittergtBbÑLv`܂B

@WebTCg̃R[h͕pɂɕύX܂B̂߈ȍ~̃ZNṼLv`ēx쐬悤ƂĂAɎ̂Ƃ͌ʂقȂ邩܂B

Twitter̃OCvZX
pPbg͂wƂAwɍŏɂĂ炤̂AigĂWebTCgւ̃OCƁÃOC̃gtBbÑLv`łBɂ͂ӂ̖ړI܂BpPbgʂɂĒmĂ炤̂ƁÃpX[hlbg[NƂ肳Ă邱ƂĂ炤ƂŁAX̍Ƃǂꂾ댯ɋCt邽߂łB
KɂTwitter̔F؏ɂ͂قǖ͂܂B}8-1番悤ɁAŏ3̃pPbǵA[J̃p\Ri172.16.16.128jy1zƃ[gT[oi168.143.162.68jy2zƂTCPnhVFCN\Ă܂B[gT[o443ԃ|[gŐڑ҂󂯂Ă܂y3zBSSL over HTTPAʂHTTPSƏ̂ZLAȃf[^]@Ɏg|[głBꂾĂAꂪSSLgtBbNłƐł܂B

}8-1@nhVFCN443ԃ|[gƐڑ

nhVFCNɑpPbǵAÍꂽSSLnhVFCNłBSSL͌A܂ҊԂł̒ʐMÕ邽߂̕ɈˑĂ܂BnhVFCN͋@ԂŌ󂷂鐳K̂ƂłƓɁA܂܂ȃRlNVƈÍɊւݒ̃lSVG[Vł܂BnhVFCNƁAZLAȃf[^]n܂܂B
f[^̂ƂsĂÍꂽpPbgɂ́APacket DetailsyCInfoJApplication DataƂȂĂpPbgTĂB̃pPbgSSLWJƁAEncrypted Application DatatB[h\A}8-2̂悤ɈÍꂽf[^y1zi[Ă͂łB̓OC̃[UƃpX[h̓]Ă܂B

}8-2@Íꂽi񂪓]Ă

16Ԗڂ̃pPbgFIN/ACKɂRlNṼeBA_EvZXJn܂ŔF؂܂BF؂IƁAuEUTwitter̃z[y[Wւƃ_CNg܂B}8-3ŕ悤ɁA19ԖځA21ԖځA22Ԗڂ̃pPbǵA[gT[oi168.143.162.68jłA443ԃ|[gł͂Ȃ80ԃ|[gŐVȃRlNVJnnhVFCNvZXły1zBnhVFCNƁA23Ԗڂ̃pPbgWebT[õ[gfBNgi/jvHTTP GETNGXgs܂y2zBT[o24Ԗڂ̃pPbgŃNGXgACKsy3zÂ̃pPbgł̃f[^]Jn܂B41Ԗڂ̃pPbg̃RecGETNGXgɊ֘Af[^]̊Ă܂B

}8-3@F؊Twitterz[y[W̃[gfBNgi/jւGETNGXg

z[y[W烊Nꂽ摜Ȃǂ̃t@C擾邽߁Aɉ񂩂GETNGXgLv`t@CɊi[Ă܂B

cC[gł̃f[^M
OCAx݂͂Ȃ񂪉lĂ邩SEɓ`ԂłB͖{Mł̂ŁAuThis is a tweet for Practical Packet Analysis, second editioni͎HpPbg͑2ł̂߂̃cC[głjvƂɃcC[gĂ݂܂B̃cC[g𓊍eۂ̃gtBbNLv`̂t@Ctwitter_tweet.pcapłB
̃Lv`t@ĆAcC[gMꂽォn܂ĂA܂̓[J̃Rs[^172.16.16.134ƃ[gAhX168.143.162.100Ԃ̃nhVFCNsĂ܂B4Ԗڂ5Ԗڂ̃pPbǵANCAgT[o֑ꂽHTTPpPbgłBWireshark͂2̃pPbg̃f[^gݍ킹A₷悤5Ԗڂ̃pPbgPacket DetailsyCɂ܂Ƃ߂Ă܂B
HTTPwb_邽߂ɁA5Ԗڂ̃pPbgPacket DetailsyCHTTPWJƁA}8-4̂悤URL /status/updateɑ΂POST\bhgĂ邱Ƃ܂y1zBHosttB[htwitter.com̒l܂܂Ă̂Ły2zA̓cC[g̃pPbgƂƂɂȂ܂B

}8-4@TwitterXV̂߂HTTP POST

}8-5Line-based text datatB[hy1zɏ񂪊܂܂Ă邱ƂɋCÂł傤B̃f[^͂ƁAAuthenticity TokenƂtB[hƁAURLɎ̂悤Ȓl܂statustB[hmFł܂B

This+is+a+tweet+for+practical+packet+analysis%2c+second+edition

statustB[h̒ĺAÍĂȂőMcC[głB
Ȃɂ̓cC[gꕔ̐lXɂJĂȂl̂ŁAɂ͎኱̃ZLeBʂł̕s܂BƂĒNcC[gǂ߂킯ł͂ȂÃgtBbNMłAcC[g̒gׂČ邱Ƃł̂́Albg[Ñ[UłB

}8-5@̃cC[g

Twitter̃_CNgbZ[W
x͂̃ZLeBViIlĂ݂܂傤BTwitter̃_CNgbZ[ẂA[UɌlIȃbZ[WLł̂łBtwitter_dm.pcapt@ĆATwitter̃_CNgbZ[W̃pPbgLv`łB}8-6悤ɁA_CNgbZ[W͊SɃZLAȂ̂ł͂܂B

}8-6@_CNgbZ[W

}8-67Ԗڂ̃pPbǵARec͂蕽őMĂ邱ƂĂ܂Bقǂ̃Lv`t@CLine-based text datatB[hł̂̏؋łB
TwitterɂČ邱Ƃ́AK悤ȂƂł͂܂BMłȂlbg[Nł́AvCx[gTwitterbZ[Wpďdvȃf[^𑗐M͍̂l悢AƂƂłB

FacebookgtBbNLv`
cC[g̉ǂÎŁAxFacebookɃOCāAFBɂȂĂĂ邱Ƃ𒭂߂āACɂȂĂ݂Ȃ܂BWiresharkgFacebook̃gtBbNLv`ĉ͂Ă݂܂傤B

Facebook̃OC
facebook_login.pcapt@CɃLv`OCn߂܂傤BLv`́A}8-7̂悤ɎȋMJnĂ܂BTwitter̃OCƓlɁA443ԃ|[gTCPnhVFCNsy1zARs[^172.16.0.122y2zAF؏sT[o69.63.180.173y3zƒʐMJn܂BnhVFCNSSLnhVFCNsy4zAOĈ߂̎i񂪑M܂B

}8-7@OC̎iHTTPSɂăZLAɑM

Twitter̔F؏Ƃ̈Ⴂ́AOC̎ȋMAF؂ɎgꂽRlNṼeBA_EɍsȂƂłB̑}8-8ŃtH[JXĂ悤ɁA12Ԗڂ̃pPbgHTTPwb_/home.phpւGETNGXg邱ƂmFł܂y1zB

}8-8@F؂̌A/home.phpւGETNGXgs

F؂ɎgꂽRlNV́A}8-9̃Lv`t@C̍Ōɂ64Ԗڂ̃pPbgy1zɂ悤ɁAhome.php̃Rec]ƃeBA_E܂B܂80ԃ|[gHTTPڑeBA_Ei62Ԗڂ̃pPbgjy2zA443ԃ|[gHTTPSڑeBA_E܂B

}8-9@HTTPڑAHTTPSڑeBA_E

Facebook̃vCx[gbZ[W
OCF؏ɑāAvCx[gbZ[WǂĂ邩Ă܂Bfacebook_message.pcapt@Cɂ́AFacebook̕M҂̃AJEgʂ̃AJEg֑ꂽbZ[WLv`pPbg܂܂Ă܂Bt@CJƃpPbg̐ȂƂɋł傤B
ŏ2̃pPbǵAbZ[Ŵ̂𑗐M邽߂HTTPgtBbNłB2Ԗڂ̃pPbgHTTPwb_JƁA}8-10̂悤ɒ߂URLPOST\bhőMĂ܂y1zBĂ̒ʂAɂAJAXւ̎QƂ܂܂Ă܂B

}8-10@AJAXQƂHTTP POST

AJAXiAsynchronous JavaScript and XMLj́AobNOEhŃT[o擾ΘbIWebAvP[V\z邽߂́ANCAgTCh̎@łBvCx[gȃbZ[WNCAg̃uEU瑗M΁AZbVʂ̃y[Wւƃ_CNgiTwitter̃_CNgbZ[WƓlɁjƎvm܂񂪁Ał͂܂BAJAXgƂ̂́AX̃y[Wł͂Ȃ̑ΘbIȃ|bvAbv烁bZ[WMA܂Rec̃_CNg⃊[hsvƂƂӖ܂BꂪAJAX̃bĝЂƂȂ̂łB
}8-11̂悤ɁA2Ԗڂ̃pPbgLine-based text dataWJ΁AvCx[gbZ[W̓e邱Ƃł܂BTwitterlAFacebook̃vCx[gbZ[WÍꂸɑMĂ悤łB

}8-11@Facebook̃bZ[W̃RecɂȂĂ

TwitterFacebook̔r
܂TwitterFacebookƂ2WebT[rX̔F؂ƃbZ[W̋@\AꂼقȂAv[`Ă邱ƂĂ܂BvO}ȂATwitter̔Fؕ@̂قvIƎ咣ł傤BZLeB̌Ƃ́AׂẴRecmɑMFacebook̎@]邩m܂BāAFacebookł͔F؃RlNVIOɍēxF؂KvȂ߁AԎҍUiman-in-the-middle-attackjȂ܂iԎҍUƂ́Aӂ郆[UҊԂł̃gtBbNT󂵂čU邱ƁjBۂɂ́A2̔Fؕ@ɂ͂قƂǍȂ̂łA2l̃vO}Ƃs[`JꍇAႢN肤ƂƂ؂Ă܂B

̉͂̃|CǵATwitterFacebookǂ@\邩ł͂ȂArΔ䂵肷邱ƂłgtBbN邱ƂłB̗́A悤ȃT[rX܂@\ȂA邢͒xR𒲂ׂ̂ɕKvȘgg݂񋟂Ă͂łB

ESPN.com̃gtBbNLv`
SNS̃`FbNIƁAŐVj[X̌oƃX|[c̓_`FbN̂KɂȂĂ܂B͂ʔȃTCĝłÂ̂ЂƂhttp://www.espn.com/łBhttp_espn.pcapESPNTCguEYgtBbNLv`܂B
̃Lv`t@Cɂ956̃t@C܂܂Ă܂Bꂼ̃RlNVُmF邽߂ɁA蓮ŃXN[ăt@CŜĂ̂͂܂ɂςȂ̂ŁAWireshark̉͋@\gčƂȒPɂĂ݂܂傤B

ConversationsEBhE̗p
ESPÑz[y[Wɂ̃N@\܂܂Ă̂΁Af[^]ɖ1000̃pPbgKvȗR[ł܂Bʂ̃f[^]ꍇAf[^̎擾mĂƕ֗łAɏdvȂ̂́A擾ЂƂȂ̂Ȃ̂cĂƂłBWiresharkConversationsEBhEi[Statistics][Conversations]Ij𗘗p΂ꂪ킩܂B

}8-12̗ł́A14IPɂΘbA25TCPRlNVA14UDPɂΘbACConversationsEBhEɏڂ\Ă܂BЂƂ̃TCgƂẮAԂ񑽂̂ƂsĂ܂B

}8-12@̃RlNV\ĂConversationsEBhE

Protocol Hierarchy StatisticsEBhE̗p
̏󋵂ɂ悭邽߁ATCPRlNVUDPŎgĂAvP[VwvgRĂ݂܂傤B[Statitics][Protocol Hierarchy]IA}8-13[Protocol Hierarchy Statistics]EBhEJ܂B

}8-13@vgR\[Protocol Hierarchy Statistics]EBhE

TCPAJEg̓pPbg97.07p[Zg߁y1zAUDPAJEg͎c2.93p[Zgy2zƂȂĂ܂B\zǂTCPgtBbNHTTPły3zAHTTPoRœ]t@C^CvʂɂɕނĂ܂B
WiresharkłHTTP12.66p[Zĝ݂ƕ\Ă̂ŁATCPgtBbNׂ͂HTTPƂƍ邩m܂񂪁Ȃ84.41p[Zg͏TCPgtBbNƂӖȂ̂łif[^]ƐpPbgjBUDPs̉̃GgƁAUDPgtBbNׂ͂DNSły4zB
̏񂾂łA̌_o܂BЂƂDNSgUNVɏȂƂƂłBDNSpPbg28̂Łi}8-13[Domain Name Service]Ggׂ̗PacketsJɕł܂jADNSgUNV͍ōł14ƂӖɂȂ܂BNGXgƃX|XňgȂ̂ŁApPbg̑2ŊĂ̐oĂ܂B[Conversations]EBhEUDPs̉ƁAm14̑ΘbĂāA̐Ƃؖ܂B
DNSNG͉炩̌_@Ĕ܂B܂Lv`̂̑̃gtBbNHTTPgtBbN݂̂łB̂ƂAESPNTCgHTMLR[hDNSő̃hC܂̓TuhCQƂĂ邽߁ÃNGsĂ邱Ƃ@܂B
̘_𗠕t؋TĂ݂܂傤B

DNSgtBbNQƂ
tB^쐬΁ADNSgtBbN邱ƂȒPɂł܂BWiresharkEBhẼtB^ɁudnsvƓ͂ƁA}8-14̂悤ɁAׂĂDNSgtBbNQƂł܂B

}8-14@WNGƃX|X̂悤ɌDNSgtBbN

}8-14DNSgtBbŃAׂăNGƃX|X̂悤Ɍ܂BNGꂽDNS悭ɂ́ANĜ݂\悤ȃtB^쐬܂BtB^쐬ɂ́APacket ListyCŃNG̃pPbgIAPacket DetailsyCŃpPbgDNSwb_WJ܂B[FlagsF0x0100iWNGj]tB[hENbNA[Apply as Filter]Ƀ}EXĂA[Selected]I܂B
dns.flags == 0x0100ƂtB^LƂȂANG\悤ɂȂ̂ŁA͂Ă郌R[hƓǂ݂₷Ȃ܂B܂}8-14悤ɃNG14܂iepPbgNG\ĂjAׂẴhCESPN֘Â悤Ɍ܂̂ŁAz[y[Wŕ\ĂRecɊ֘AĂ悤Ɍ󂯂܂B

HTTPNGXg
ŌHTTPNGXg𒲂ׁÃNG̑M؂܂B̂߂ɂ[Statistics][HTTP]I[Requests]IA[Create Stat]NbN܂isOɁAقǍ쐬tB^̂YꂸɁjB
}8-15[HTTP Requests]EBhEĂ܂Bɕ\Ă14̃RlNVies͓hCւ̃RlNV\Ă܂j́ADNSNGꂽhCĂ܂B

}8-15@ANZXꂽhC\HTTPNGXg̊TvEChEɕ\Ă

̃RlNVĂ܂AȀuōsꂽ̂ǂɋ̂ƂłBmFƂȒPȕ@́AgtBbN̊Tv邱ƂłB[Statistics][Summary]I܂傤B}8-16Ɏ[Summary]EBhEƈȀ2bōsꂽƂ܂y1zB
Weby[WƂȒPȃNGXg14̈قȂhCTuhCւ̃NGXgƂȂA܂܂ȃT[oƂƂsAł̏Ŝ2bĂȂƂ͕̂svcȊ܂B
Cɓ̃TCg֖K₵ȂgtBbNLv`Â悤ɉ͂Ă̂͗KƂĂʔ̂ł͂Ȃł傤BpPbgȂAf[^{͂ǂ痈Ă̂͂킩Ȃ̂łB

}8-16@[Summary]EBhEɂŜ̏2bȓł邱Ƃ\

ł̃gu
x͖܂ރgtBbN̗Ă܂傤B푽lȃC^[lbgANZXɂ܂guƁAsȃv^xЂ̐ڑ̖xǁAT^IȖĂ܂傤B

C^[lbgɐڑłȂFݒ̖
ŏ̃gũViÍA[UC^[lbgɐڑłȂƂ̂łB̃Rs[^̋LA[JT[õAvP[Vւ̃ANZX܂ށACglbĝׂẴ\[XɃANZXł邱Ƃ͊mFςłB
ׂẴNCAgƃT[oPȃXCb`oRŐڑĂAlbg[ÑA[LeN`͂ȂPłBC^[lbgւ̃ANZX̓ftHgQ[gEFCƂċ@\P̃[^oRŏAIPAhXDHCPɂĒ񋟂Ă܂BK͂ȃItBXł͔ɈʓIȃViIłB

P[uւ̐
gǔ𔻒f邽߁AXjbt@lbg[NĎĂŒɃC^[lbg̃uEYsĂ炢܂By[Wiۂ̃y[Wj ́uXjbt@ۂɐݒuvɋLڂi}2-15jɂAXjbt@zûɓK؂ȏꏊ𔻒f܂B
lbg[ÑXCb`̓|[g~[OɑΉĂ܂BeXgɋ͂ĂĂiKŁAłɃ[U̍ƂזĂ܂Ă̂ŁAēxItCɂȂĂvł傤iOqƂA^bvĝP[uɐōœK̕@Ȃ̂ŁjB̌ʎ擾t@Cnowebaccess1.pcapłB

pPbg
gtBbÑLv`́A}8-17̂悤ɁAARPNGXgƃX|XŎn܂܂BMACAhX00:25:b3:bf:91:eeAIPAhX172.16.0.8̃[ŨRs[^́A1Ԗڂ̃pPbgŁAftHgQ[gEFCł172.16.0.10IPAhXɑΉtꂽMACAhX邽߂ɁAlbg[NZOĝׂẴRs[^ARPu[hLXgpPbg𑗐M܂B

}8-17@ftHgQ[gEFCɑ΂ARPNGXgƃX|X

2Ԗڂ̃pPbg2ŃX|X󂯎[ŨRs[^́A172.16.0.1000:24:81:a1:f6:79ł邱Ƃ킩̂ŁAC^[lbgւƌQ[gEFCւ̌oHm܂B
ARPX|XɑARs[^3Ԗڂ̃pPbgŁADNSgIPAhX疼O݂Kv܂B}8-18Ɏ悤ɁAvC}DNST[oł4.2.2.2DNSNGpPbg𑗐M܂y1zB

}8-18@4.2.2.2ɑMꂽDNSNG

ʂ̏󋵂ƁADNST[oDNSNGɔɐvɉ܂Ał͂ȂĂ܂Bł͂ȂADNSNGēxʂ̃AhXւƑMĂ܂B}8-19ł́A4Ԗڂ̃pPbg2ڂDNSNGAZJ_DNST[o4.2.2.1ɑMĂ܂y1zB

}8-19@4.2.2.1ɑMꂽ2ڂDNSNG

܂DNST[ỏ͂ȂANG1bɍēxA4.2.2.2ւƑM܂B̃vZX͐}8-10番悤ɁAvC}DNST[oy1zƃZJ_y2zւƌ݂ɃpPbg𑗂Ƃ`ŁAbԌJԂ܂B̏Ŝɂ鎞Ԃ͖8bły3zB̓[ŨuEUAWebTCgɐڑłȂƕ񍐂܂łɗv鎞ԂƂȂ܂B

}8-20@ʐMf܂DNSNGJԂ

pPbggǔ肵Ă݂܂傤B܂AftHgQ[gEFCƍlĂ郋[^ւARPNGXgĂ邱ƂA̒ʐM@͓삵ĂAʐM\Ƃ킩܂B܂[ŨRs[^͎ۂɃpPbg]Ă̂ŁARs[^̂ɃvgRX^bN̖͂ȂƐł܂B͖炩ɁADNSNGXgsꂽ_ŋNĂ̂łB
ł́ADNSNGC^[lbg̊OT[oi4.2.2.2܂4.2.2.1jɂĉ܂B܂薼OK؂ɍsɂ́AC^[lbgɃpPbg[eBO郋[^DNSNGDNST[oւƓ]AT[oɉKv̂łB̂Ƃׂ͂āAWeby[W̃NGXgHTTPpOɍs܂B

C^[lbgɐڑłȂ[U[ɂ݂͑Ȃ̂ŁA[^ƊODNST[o͂炭̌ł͂ȂƂ܂BƗB^킵̂A[ŨRs[^łB
̃Rs[^ڂׂĂ݂ƁADHCP蓖ĂAhX󂯎ݒɂȂĂ炸A蓮ŃAhX񂪐ݒ肳Ă߁AftHgQ[gEFC̃AhXݒ肪K؂łȂƂ܂BftHgQ[gEFCƂĐݒ肳ꂽAhXsK؂߁ADNSNGpPbg]łȂ̂łB

Ŋw񂾂
̃ViÍ̖ANCAg̐ݒ~Xɂ܂B莩̂͂ȂPȂ̂łA[Uɂ͑ȉe^̂łB̂悤ȒPȐݒ~X̃guV[eBOłAlbg[Nm̂ȂlAƂpPbg͂s\͂Ȃ΁AȂ̎ԂvĂ܂܂BpPbg͂͑K͂ŕGȃguƂ̂̂ł͂Ȃ̂łB
̃ViIł́AftHgQ[gEFCIPAhXĂȂ̂ŁAWiresharkł̓gǔmł܂łAǂmFׂĂꂽ߁AMdȎԂߖł܂BftHgQ[gEFC𒲂ׂAISPɘAAODNST[õguV[eBOsT肷邱ƂȂAgǔłRs[^̂̂ɏW邱Ƃł̂łB

@lbg[NIPAhX̌nmĂ΁A͂ɑs܂BARPNGXgMꂽIPAhXftHgQ[gEFC̃AhXƈႤƋCÂ΁Ãgǔ͂ɔ̂łBPȐݒ~X͂΂΃lbg[Ngu̍ƂȂ܂ApPbg͂sŒʏ͊ȒPɉł܂B

C^[lbgɐڑłȂFsK؂ȃ_CNg
̃ViIłARs[^C^[lbgɐڑłȂ[UɍēxoꂵĂ炢܂傤BȂقǂƂ͈قȂAx̃[U̓C^[lbgɂ͐ڑł̂łÃz[y[Włhttp://www.google.com/ɐڑł܂BGoogle񋟂hCɃANZX悤ƂƁAuInternet ExplorerWeby[W\ł܂vƂy[WɃ_CNgĂ܂܂BguNĂ̂͂̃[UłB
قǂ̃ViIlA̊ȒPȃXCb`ƁAftHgQ[gEFCƂċ@\郋[^1݂̂ō\ꂽK͂ȃlbg[NłB


P[uւ̐
͂n߂邽߁A^bvgă[Uhttp://www.google.com/uEYĂۂɐgtBbNLv`܂B̌ʂ̃t@Cnowebaccess2.pcapłB

pPbg
gtBbÑLv`́A}8-21̂悤ɁAARPNGXgƃX|XŎn܂܂BMACAhX00:25:b3:bf:91:eeAIPAhX172.16.0.8̃[ŨRs[^́A1Ԗڂ̃pPbgŁA172.16.0.102IPAhXɑΉtꂽMACAhX邽߂ɁAlbg[NZOĝׂẴRs[^ARPu[hLXgpPbg𑗐M܂B̎_ŁAIPAhX̖͕słB

}8-21@lbg[N̕ʂ̋@ւARPNGXgƃX|X

2Ԗڂ̃pPbgŁAIPAhX172.16.0.10200:21:70:c0:56:f0łƕ܂Bقǂ̃ViIlA̓ftHgQ[gEFCIPAhXƂāADNSpPbg͂̃AhXgĊODNST[oɓ]̂Ɛ肵Ă݂܂傤BƂ낪}8-22ƁÃpPbgDNSNGXgł͂ȂA172.16.0.8172.16.0.102ւTCPpPbgłBSYNtOZbgĂƂƂ́A2̋@ԂŐVTCPRlNVm邽߂̃nhVFCŃAŏ̃pPbgƂƂɂȂ܂y1zB

}8-22@̋@킩ʂ̓̋@ւƑꂽTCP SYNpPbg

ڂׂ_ƂāAʏHTTPgtBbNɎg80ԃ|[gŁy2zA172.16.0.102y3zɑ΂TCPRlNV̊msĂ܂B}8-23Ɏ悤ɁÃRlNV̎śA172.16.0.102RSTACKtOZbgTCPpPbgi4Ԗڂ̃pPbgjy1zX|XƂđM_ŒfĂ܂܂B
6͂ŁARSTtOZbgpPbgTCPRlNV̏IɗpƂƂv܂傤BȂ獡̃ViIł́A172.16.0.8̃Rs[^A172.16.0.102̋@80ԃ|[gTCPRlNVm悤ƂƂA̋@ł́A80ԃ|[gŃNGXg҂󂯂T[rXݒ肳ĂȂ߁ATCP RSTpPbgăRlNVIĂ܂Ă܂B}8-24̂悤ɁAʐMSɏI܂łɁA[ŨRs[^SYNARSTZbgꂽX|X߂ĂƂ͂2JԂĂ܂B̌テ[ŨuEUɁAy[W\ł܂ƂbZ[W\܂B

}8-23@TCP SYNւ̉ƂđꂽTCP RSTpPbg

}8-24@TCP SYNRSTpPbg͍v3񑗂Ă

Ɠ삵Ăʂ̃lbg[N@̐ݒ𒲂ׂƁA1Ԗڂ2Ԗڂ̃pPbgARPNGXgƃX|Xɖ肪\яオĂ܂BARPNGXgftHgQ[gEFCMACAhXł͂ȂAʂ̕sȋ@ɑĂ̂łB܂AARPNGXgƃX|XǐՂ΁Awww.google.comɑΉtꂽIPAhX邽߂ɁADNST[oɑMDNSNGƎv̂łA܂BDNSNG̐sȂR2܂B

ERlNVm悤Ƃ@DNSIPAhXłDNSLbVɊi[ĂB
EDNSɑ΂RlNVm悤Ƃ@킪ADNSIPAhX̑ΉtAhostst@CɕێĂB

NCAg̃Rs[^ɒׂĂ݂ƁARs[^hostst@Cwww.google.com̃GgAꂪIPAhX172.16.0.102ɑΉtĂ܂B̊ԈGg[ŨguNĂ̂łB

ʓIɁARs[^DNSIPAhX̑ΉtɊւ񌹂Ƃhostst@C𗘗pAOɖ₢킹Oɂ̃t@CmF܂B̃ViIł́A[ŨRs[^hostst@CmFwww.google.com̃GgAwww.google.com̓[J̃lbg[NɂƔf܂B̂ARPNGXgY̋@ɑăX|X󂯂ƂA172.16.0.10280ԃ|[gTCPRlNVm悤Ƃ̂łB̋@킪WebT[oƂĐݒ肳ĂȂ߁ARlNVmłȂ킯łB
hostst@C̃Gg폜邱ƂŁA[ŨRs[^͐ʐMJnAwww.google.comɐڑł悤ɂȂ܂B

@WindowsVXehostst@CmFɂ́AC:\Windows\System32\drivers\etc\hostsQƂĂBLinux̏ꍇ/etc/hostsQƂĂB

̃ViI͔ɂ悭N܂B́A}EFAN̊ԁA[UӂR[hߍ܂ꂽWebTCgɃ_CNg邽߂ɗpĂ@ł܂BU҂hostst@CςAICoLOփANZX悤ƂxɁA𓐂݂UTCgփ_CNgĂƂǂł傤I

w񂾂
gtBbN̉͂𑱂ĂƁA܂܂ȃvgR̓ƁA̎Ւf̎d̗wł܂B̃ViIł́AOIȐݒ~Xł͂ȂANCAg̐ݒ~X̂߂ɁADNSNGM܂łB
pPbgxł̃gu𒲂ׂƁAsIPAhXƁAʐM̌ƂȂDNSȂƂɕ܂B̏ɂāANCAǧłƔ̂łB

C^[lbgɐڑłȂFʂ̖
2̃ViIlÃViIłA[URs[^C^[lbg֐ڑłȂƕĂ܂B̃[Ǔ͖ЂƂWebTCgAhttp://www.google.com֍i荞݂܂BɒׂĂ݂ƁA̖肪gDŜɉeĂ邱Ƃ܂BNGooglehCփANZXłȂ̂łB
2̃ViIƓ悤ɁÃlbg[N̃XCb`ƁAC^[lbgւƂȂ1̃[^ō\Ă܂B

P[uւ̐
guV[eBÔ߂ɁA܂http://www.google.comuEYăgtBbN𐶐܂Bgu̓lbg[NŜɋyłA܂莩̃Rs[^e󂯂ĂAK͂ȃ}EFẢ\邽߁ÃRs[^璼ڃLv`ׂł͂܂B̂悤ȏ󋵂ɒuꂽꍇA^bvŗǂ̑IƂȂ܂BT[rX̊Ԓf邾ŁA͉KvȂłB^bvɂLv`̃t@Cnowebaccess3.pcapɂȂ܂B

pPbg
̃pPbgLv`́AARPgtBbNł͂ȂDNSgtBbNŎn܂܂Bŏ̃pPbg͊OAhXŁA2Ԗڂ̃pPbgɂ͂̃AhX̃X|XƂȂĂ̂ŁAARP͂łɍsĂAftHgQ[gEFCMACIPAhXƂ̑Ήt͂ł172.16.0.8̋@ARPLbVɑ݂ĂƉł܂B
}8-25Ɏ̂ARs[^172.16.0.8AhX4.2.2.1֍ŏɑꂽpPbg̃Lv`y1zŁADNSpPbgły2zBpPbg̓e𒲂ׂƁAwww.google.comAR[h̃NGł邱Ƃ킩܂y3zB

}8-25@www.google.comAR[hDNSNG

4.2.2.1̃NGւ̃X|XA}8-262Ԗڂ̃pPbgłBPacket DetailsyCmFƁÃNGXgɑ΂郌X|Xԋpl[T[oANGɑ΂ĕ̉񓚂񋟂Ă邱Ƃ܂y1zB܂łׂ͂ėǍDŁAʐM؂ȂsĂ܂B

}8-26@AR[h܂܂ꂽDNSX|X

[ŨRs[^WebT[oIPAhXmF̂ŁAWebT[oƂ̒ʐM̎s\ɂȂ܂B}8-27̂悤ɁÃvZX172.16.0.874.125.95.105֑ꂽ3Ԗڂ̃pPbgATCPpPbgŎn܂܂y1zB̃AhX́A2Ԗڂ̃pPbgADNSNGɑ΂郌X|XŒ񋟂ĂAAR[hQ̂擪̃AhXƂȂĂ܂BTCPpPbgɂSYNtOZbgĂy2zA[gWebT[o80ԃ|[gł̒ʐMsĂ܂y3zB

}8-27@80ԃ|[gł̃RlNVJnsSYNpPbg

TCPnhVFCNvZXȂ̂ŁAƂTCP SYN/ACKpPbg߂͂łAƕʂSYNpPbgAM父ւƑĂ܂B}8-28Ɏ悤ɁȀ͂ɖ1bɂĂAŒʐMfAuEUWebTCgȂƕ񍐂Ă܂B

}8-28@X|XȂTCP SYNpPbg3xMĂ

4.2.2.1̊ODNST[oւDNSNGĂ邱ƂAlbg[ÑRs[^Oɐڑł͕̂Ă܂BDNST[õX|XɊ܂܂IPAhXɂ͂ȂARs[^͂̂̃AhXւ̐ڑsĂ܂BڑɗpĂ郍[J̃Rs[^Ɠ삵Ă悤łB
́A[g̃T[oRlNṼNGXgɉȂA܂TCP RSTpPbgԐMȂƂłBɂ͂̗Rl܂BWebT[o̐ݒ~XAWebT[õvgRX^bN̋@\sSA邢̓[g̃lbg[ÑpPbgtB^it@CAEH[jȂǂłB[JŃpPbgtB^͍sĂȂƉ肷ƁAl̓[g̃lbg[NɂƂƂɂȂAグłBłWebT[o@\Ă炸Aڑ݂̎܂܂łBGoogleŖ肪΁AʐM\ɂȂ܂B

w񂾂
̃ViĨgúA瑤ł͑ΉłȂ̂łBpPbg͂̌ʁAgu̓[J̃lbg[N̋@łA[^łAOT[rX񋟂ODNST[ołȂƔ߂łB̍́AXǗlbg[NOɂ܂B
gǔɂȂƂƁAXgXy邾łȂAǗɕꂽƂ̖̑ʂ~܂BB̂ȂƎ咣ISPx_A\tgEFAЂƉxPJĂ܂ÂƂApPbg͉R܂B

sȃv^
ITwvfXNǗguɂĂĂ܂Bcƕ̃[ÚAcƂŎgĂ^v^guĂƕ񍐂Ă܂Bʂ̈Wu𑗂ƁAy[WŒ~Ă܂Ƃ̂ƂłBhCoݒxςĂ݂܂A܂Ȃ悤łBwvfXÑX^bt́Aꂪlbg[N̖ł͂ȂǂmFĂقƌĂ܂B

P[uւ̐
̓v^̃guȂ̂ŁAł邩v^ɋ߂ƂɃXjbt@ݒu邱Ƃn߂܂Bv^{̂ɂWiresharkCXg[ł܂񂪁Albg[NŎgpĂ͍̂ŐV^L3XCb`Ȃ̂ŁA|[g~[Og܂Bv^ڑĂ|[g󂢂Ă|[gփ~[AWiresharkCXg[ꂽRs[^̃|[gւȂ܂Bݒ肪Av^ɑʂ̈Wu𑗂Ă炢Ao͂Ď܂BLv`t@Cinconsistent_printer.pcapłB

pPbg
}8-29킩悤ɁAWu𑗂ĂRs[^i172.16.0.8jƃv^i172.16.0.253jԂTCPnhVFCNLv`t@C̐擪ōsĂ܂BnhVFCNɑA1460oCgTCPpPbgv^ɑ܂y1zBf[^ʂ́APacket ListyCInfoJ̈ԉE[APacket DetailsyCTCPwb_̈ԉŊmFł܂B

}8-29@TCPŃv^ɓ]ꂽf[^

}8-30̂悤ɁA4Ԗڂ̃pPbgɑA1460oCg̃f[^܂񂾃pPbgЂƂy1zAv^ACKԋpĂ܂y2zB

}8-30@ȃf[^]TCPACK

Lv`t@C̍Ō2̃pPbg܂ŁAf[^̂Ƃ肪܂B121Ԗڂ̃pPbgTCPđiTCP RetransmissionjpPbgŁA}8-31悤ɁAꂪgu̍ŏ̒łB

}8-31@TCPđpPbg̓gu̒

TCPđpPbǵAʐM@킪ʂ̋@ւTCPpPbg𑗐M̂ɁA̋@킪ACKԋpȂꍇɑ܂Bđ̂lɒBƁAM͈̋@킪f[^MĂȂƔfApPbgđ܂B̏͒ʐM𒆒f܂ŐJԂ܂B
̃ViIł́Av^Mꂽf[^ɑ΂ACKԐMȂ߂ɁANCAg̃Rs[^v^TCPđpPbg𑗂Ă܂BTCPwb_[SEQ/ACK analysis]WJA\΁i}8-31jy1zAꂪȂđƔfꂽ̏ڍׂ킩܂B121Ԗڂ̃pPbg120Ԗڂ̃pPbg̍đły3zB܂đpPbg̍đ^CAEgiRTOj͖5.5bły2zB
pPbgԂ̒x͂ƂA󋵂ɉĎԕ\`ύX邱Ƃł܂Bł͑ÕpPbgMꂽ̂Aǂ̂炢oĂđꂽ̂ŁA[View][Time Display Format]IсA[Second Since Previous Captured Packet]I܂BƌX̃pPbgi120Ԗڂ̃pPbgjMĂ5.5b121Ԗڂ̃pPbgđĂ邱Ƃ͂蕪܂y1zB

}8-32@pPbg̑MԊuc邱ƂguV[eBOɖ𗧂

̎̃pPbg120Ԗڂ̃pPbg̍đłB̃pPbgRTO11.10bŁAɂ͐قǂ̃pPbgRTOł5.5b܂܂Ă܂BPacket ListsyCTimeJ΁A̍đ5.6bɂ̍đsĂ̂܂B̓Lv`t@C̍Ō̃pPbgłA܂v^قړɈ𒆎~Ă܂B
̃ViIł́Ãlbg[ÑNCAgƃv^Ȃ̂ŁAǂɖ肪邩𔻒f邾ōς݂܂B΂炭̊ԃf[^̗ώ@ƁA鎞_ŁAv^NCAgւ̃X|XsĂȂƂɋCÂ܂BTCPđ悤ɁANCAg̓f[^𑗐M悤ƍőP̓w͂Ă܂Av^X|X߂Ă܂Ă̂łBǂ̃Rs[^v^Wu𑗂낤Ƃ̖͔̂ŁAv^ɌƉ肵Ă݂܂B
ɉ͂ƁAv^RAMɈُ𔭌܂Bʂ̈WuĂy[WȂ̂́Â̈ɃANZX܂łĂȂ̂悤łBǂ́A̖ɂāAv^Vf[^󂯎邱ƂłANCAgɂWȗM𒆒fĂ܂Ă̂łB

w񂾂
̃v^̃gu̓lbg[Ñguł͂܂񂪁AWiresharkgČ邱Ƃł܂B܂ł̃ViIƂ͈ႢATCPgtBbN݂̂ΏۂƂĂ܂BKȂ̂́A2̋@ԂŒʐMfĂ܂ۂɁATCP͗LvȏcĂ邱ƂƂłB
͒ʐMˑR~ƂɁATCPđ@\̂ŁẢӏ𐳊mɔc邱Ƃł܂BViIǂݐi߂ĂŁA蕡GȃguꍇłA@\ɗ邱Ƃ͂悭܂B

Ǘx
̃ViIɓoꂷ̂́A{ЂƁAVɐݗꂽ΂̎xЂƂłB̊ƂITCt̂قƂǂ{ГɂAWindowsT[õhCpĂ܂BZJ_hCRg[ÃhCRg[́AxЂDNSƔF؃NGXgĂ܂BhCRg[̓ZJ_DNST[ołA{ЂɂʂDNST[o烊\[XR[h̏󂯎悤ɂȂĂ܂B

fvCg`[xЂɐVCt̓sĂۂɁAlbg[ÑCglbgWebAvP[VT[oɎxЂNANZXłȂƂ܂B̃T[o͖{ЂɂAWANoRŃANZX悤ɂȂĂ܂BxЂ̎ЈSANZXłȂ̂łAȂ̂͂T[ô݂ŁAC^[lbgƎxЂ̂ق̃\[Xɂ̓ANZXł̂łB
}8-33͍̃ViIɓoꂷ@Ă܂B

}8-33@WIȎxЂ̃lbg[N̍\@
x
NCAg@172.16.16.101
xЂ̃[^
xЂ̃X[uDNST[o@172.16.16.251

WAN

{
{Ђ̃[^
{Ђ̃AvP[VT[o@172.16.16.200
{Ђ̃}X^DNST[o@172.16.16.250

P[uւ̐
͖{ЂƎxЊԂ̒ʐMɂ̂ŁAgu̒ǐՂn߂邽߂ɂ̏ꏊŃf[^W܂BxЂ̃NCAgɖ肪\lāÂ1|[g~[O邱Ƃn߂܂傤BWAgĒǉŃf[^Wꏊ߂܂BNCAgWŏ̃Lv`t@Cstranded_clientside.pcapłB

pPbg
}8-34̂悤ɁAAhX172.16.16.101̃Rs[^̃[UA{Ђ̃AvP[VT[o172.16.16.200Œ񋟂ĂAvP[VɃANZX悤ƂƂAŏ̃Lv`t@Cn܂Ă܂B̃Lv`ɂ2̃pPbg܂܂Ă܂Bŏ̃pPbgɓĂ̂́Aappservery3zAR[hy2z߂172.16.16.251ɑꂽDNSNGXgy1ẑ悤łB͖{Ђɂ172.16.16.200̃T[oDNSłB
}8-35番悤ɁÃpPbgɑ΂郌X|XT[oQiserver failurejy1zƂȂĂ܂B́ADNSNGsƂĂ܂B̃pPbg̓G[iT[oQĵ߁ANGɑ΂ĉ񓚂Ă܂y2zB
ŁAʐM̃guDNSɊ֌WĂ邱Ƃ킩܂BxЂDNSNG172.16.16.251DNST[oŉ̂ŁAꂪ̃|CgƂȂ܂B

}8-34@appserverAR[hɑ΂DNSNGŎn܂ʐM

}8-35@NG̃X|Xʂ̖Ă

xЂDNST[õgtBbNK؂ɃLv`邽߁AXjbt@͐ݒu܂܂ŁA|[g~[O̐ݒύXăNCAg̃gtBbNł͂ȂDNST[õgtBbN~[悤ɂ܂B̌ʂ̃t@Cstranded_branchdns.pcapłB
}8-36̂悤ɁÃLv`͐قǌNGƃX|XAĂЂƂ̃pPbgŎn܂Ă܂B̃pPbg͂ƖȊłBDNS̕Wł53ԃ|[gy2zŖ{Ђ̃vC}DNST[oi172.16.16.250jy1zƂ̒ʐM݂Ă܂AUDPł͂Ȃły3zB
̃pPbg̖ړImɂ́A7͂DNS̐voĂBDNS͒ʏUDPg܂ANGւ̃X|XTCY𒴂ꍇATCPg܂B̏ꍇAŏUDPgtBbNTCPgtBbNNĂ悤łBTCP͂܂][]A܂胊\[XR[hDNST[oԂœ]ۂɂg܂ÃP[X͂̂悤łB

}8-36@SYNpPbg53ԃ|[ggĂ邪UDPł͂Ȃ

xЂɂDNST[o͖{ЂDNST[õX[ułA\[XR[hɂĂ͖{ЃT[oɈˑĂ邱ƂɂȂ܂BxЂ̎ЈANZX悤ƂĂAvP[VT[o͖{ЂɂA{ЂDNST[õT[oǗĂ܂BxЃT[oAvP[VT[oւDNSNGXgɂ́ÃT[oDNS\[XR[hA{DNST[oxDNST[oւƓ]Ȃ΂Ȃ܂BLv`t@CSYNpPbgĂ̂͂̂߂ƍl܂B
SYNpPbgɉȂ̂́ADNSguAxЂƖ{ЂDNST[oԂł̃][]Qɂ邩łBɈiŁA][]sRĂ݂܂傤BƐl͖{ЎxЊԂ̃[^A{ЂDNST[ô̂łƂƂ܂ōi荞߂܂B{DNST[õgtBbNLv`āASYNpPbgDNST[o֑Ă邩ǂĂ݂܂B
{DNST[ogtBbÑLv`t@C͂܂BgtBbN݂ȂłBSYNpPbg̓T[o֓͂ĂȂ̂łBZp҂𑗂Ė{ЂƎxЂȂ[^̐ݒmFĂƂA{Ѓ[^53ԃ|[gł̓CoEhUDPgtBbN݂̂ATCPgtBbN͋ۂ悤ݒ肳ĂƂ܂BPȐݒ~XAT[oԂ̃][]jQAxЂ̃NCAg{Ђ̋@ɑ΂NG̉jQĂ̂łB

w񂾂
ƍ߃h}΁Albg[NʐMgȗ{ɂĂȂwKł܂Bƍ߂NƁAY͂܂֌W҂̎ނɒ肵܂BŎ肪𓾂āAɑ{ƂƂAƐl܂ő̂łB
̃ViIł́AQҁiNCAgj̒n߁ADNSʐM̃gu邱Ƃŉւ̎肪𓾂܂B̎肪肩AxЂDNST[oA{Ђ̃T[oAŏIIɂ̓gǔł郋[^܂łǂ̂łB
pPbg͂sꍇApPbg͎肪肾ƍl悤ɂ܂傤B肪肪N߂ƂĂ͂Ƃ͌܂񂪁AŏIIɂ͔Ɛl܂œĂ܂B
xxxxx
CCJ
ITƊEł́AJ҂ƃVXeǗ҂イ_Ă܂BJ҂͂AvO̕s́Albg[N̎蔲ݒƋ@̋@\sŜƕĂ܂BVXeǗ҂́Albg[NG[ƒʐM̒x̓R[hɖ肪ƔĂ܂B
̃ViÍAJ҂A̓X܂̔グǐՂĒf[^x[Xւƕ񍐂ԂAvP[VJƂłBʏ̉cƎԒ͑шߖ񂷂邽߁A̓A^CȃAvP[Vł͂܂B񍐃f[^͓~ςAԂCSVt@CƂĒf[^x[Xɏ܂܂B
Ƃ낪̐VKJAvP[V@\܂BX܂瑗ꂽt@C̓T[oMĂ܂Af[^x[Xɏ܂f[^ɖ肪̂łBڂAf[^̈ʒuɊԈႢASɔĂf[^܂BvO}lbg[Nɖ肪Ƃ̂ŁAVXeǗ҂͘TĂ܂BvO}́At@CX܂璆f[^|Wg֓]rŏĂ͂ƌ̂łBނ̊ԈႢؖ̂A̖ڕWłB

P[uւ̐
Kvȃf[^W邽߂ɁAX܂̂ЂƂA܂͖{ЂŃpPbgLv`܂B̃guׂ͂Ă̓X܂ŔĂ̂ŁAlbg[Nɖ肪ƂAׂĂ̓X܂ɗBꋤʂӏłA{ЂŔĂ͂łB
lbg[NXCb`̓|[g~[OɑΉĂ̂ŁAT[oڑĂ|[g~[AgtBbNLv`܂BLv`gtBbŃAT[oCSVt@CAbv[hĂXܖɕ܂B̃Lv`t@Ctickedoffdeveloper.pcapłB

pPbg
vO}JAvP[VɂẮA܂m܂BLv`t@CFTPgtBbNŎn܂Ă悤Ȃ̂ŁAꂪۂɃt@C]Ă郁JjYȂ̂ǂ𒲍܂BʐM܂Ƃ߂Ă݂ɂ́AʐMt[Ot֗łB[Statistics][Flow Graph]IA[OK]NbN܂傤B}8-37̃OtłB

}8-37@t[OtFTPʐMЂƂ߂ŕ

̃t[OtƁA172.16.16.128172.16.16.121Ƃ̊ԂFTPRlNVݒ肳Ă܂y1zB172.16.16.128ڑJnĂ̂Ły2zꂪNCAgŁA172.16.16.121̓f[^WďT[oƐł܂Bt[OtÃgtBbNFTPvgR݂̂gĂ邱ƂmFł܂B
ł̃f[^]sĂ͂Ȃ̂ŁAFTP̒mgāA]n܂ĂpPbg̏ꏊ܂BFTPRlNVƃf[^]̓NCAgn܂̂ŁiĖ󒍁FPASV[hłȂuʏ́vFTPgtBbN̏ꍇAf[^]̓T[oJn܂jAFTPT[oւ̃f[^Abv[hɎgpAFTP STORR}hT܂傤B̂߂ɂ̓tB^ݒ肷̂ԊȒPłB
̃Lv`t@CɂFTPNGXg̃R}hUĂ̂ŁA[Filter Expression]_CAOŐS̃vgRIvV̈ꗗtB^IĂ̂ł͂ȂAPacket ListsyCŒڃtB^\z܂傤Bɂ͂܂AFTPNGXgR}ĥpPbgIKv܂Bꗗ̏㕔ɋ߂̂ŁA5Ԗڂ̃pPbgIт܂傤BPacket DetailsyC[FTP]WJA[USER]WJ܂B[Request Command: USER]tB[hENbNA[Prepare a Filter]IAŌ[Selected]Iт܂B
FTP USERNGXgR}h܂ރpPbgׂĂ𒊏otB^[Filter]_CAOɏ܂BŐ}8-38̂悤USERSTORɒu悤AtB^ҏW܂y1zB

}8-38@̃tB^̓f[^]n܂ꏊʂ̂ɖ𗧂

ENTERătB^LɂƁASTORR}h́A64Ԗڂ̃pPbg1݂ĂȂƂ킩܂y2zB
f[^]̎n܂ꏊ̂ŁAPacket ListsyC㕔[Clear]{^NbNătB^܂B
Lv`t@C64Ԗڂ̃pPbg璲ׂĂ݂ƁÃpPbgstore4829-03222010.csvt@C̓]wĂ邱Ƃ܂i}8-39jB

}8-39@FTPgē]CSVt@C

STORR}hɑpPbg͈قȂ|[ggĂ܂AFTP-DATA]ƂĎʂĂ܂Bf[^]Ă邱Ƃ͊mFł܂AvO~O̊ԈႢ͏ؖłĂ܂BLv`pPbg]ꂽt@C̓e𒊏oāAlbg[N]ꂽt@C̓ê܂܂ł邱ƂKv܂B
t@CÍĂȂ`œ]ꍇ́AZOgɕāAőgݗĂ܂B̃ViIł́Aɂ͓̂́A܂gݗĂĂȂpPbgLv`Ă܂Bf[^ׂ͂đĂ̂ŁAt@Cf[^Xg[ƂĒoAgݗĂ邾łBgݗĂɂ́AFTP-DATAXg[ɂpPbgi66Ԗڂ̃pPbgȂǁjIсA[Follow TCP Stream]NbN܂BƐ}8-40̂悤TCPXg[\܂B
f[^FTP𕽕̏Ԃœ]Ă邽ߕ\Ă܂AXg[́Ãt@CςĂȂǂ𔻒fł܂BgݗĂf[^͌X̌`ŕۑł̂ŁA[Save As]{^NbNA}8-41̂悤64Ԗڂ̃pPbgɕ\t@Cw肵܂B[Save] NbNĂB

}8-40@]Ăf[^TCPXg[ɕ\

}8-41@Xg[X̃t@Cŕۑ

ۑƁAX܃VXe]t@CƃoCgxł܂eCSVt@Cł͂łBX̃t@CMD5nbVƒot@CMD5nbVr邱Ƃł؂łA}8-42̂悤ɁAMD5nbVɂȂ͂łB
t@Cr΁AAvP[VŋNĂf[^x[XQ̌lbg[NłȂƂؖł܂BX܃VXe璆̎WT[oւƓ]t@ĆAT[oɓ_ł͉ςĂȂ̂ŁAt@C̔j̓AvP[Vt@CĂԂɋNƂɂȂ܂B

}8-42@X̃t@Cƒot@CMD5nbV

Ŋw񂾂
pPbgx̉͂΂炵̂́AႲႵAvP[VƑΛȂčςޓ_łB肪GȃAvP[V́ADꂽ̂͂邩ɑ̂łApPbgxł͖ɂȂ܂BvO}̓AvP[VˑĂsvcȃR|[lgɂċCɕał܂ASs̃R[hgGȃf[^]AǂFTPTCPA邢IPȏ̂̂ł͂܂B̊{vgR̒m𗘗p΁AʐMĂ邱ƂmFAt@C𒊏oălbg[ŇSؖ邱Ƃ\łB肪ǂقǕGɌƂĂA傹̓pPbgɉ߂ȂƊoĂ܂傤B

܂Ƃ
{͂ł́ApPbg͂ɂĖ̂ʐM̗eՂɂȂ悤Ȋ{IȃViIƂċ܂BʓIȃvgRŊ{Iȉ͂g΁Albg[ÑguǐՂAZԂŉł̂łB܂ViIɂ͒ʂȂł傤AŏЉ̓eNjbŃAXɔgủ͂ɂƖ𗧂͂łB

