=== ch08.docx
[chap]8́@{IȌẼViI

̏͂́AWiresharkgČ̃lbg[N𕪐͂ApPbg̖͂{@艺Ă܂B1ł̓lbg[NGWjAAwvfXNSҁA邢̓AvP[VJ҂ƂāAXʂViI𕪐͂܂B͂M҂⓯̎̌ɂ̂łB܂WiresharkgāATwitterAFacebookAESPN.com̃gtBbN𒲂ׁA悭gT[rXǂ̂悤ɋ@\Ă邩Ă܂B
2ł́Aۂ̖グ܂Bꂼ̖芪󋵂ƂƂɁA̎_ŃAiXgp\񋟂܂B{񎦂AK؂ȃpPbgLv`邽߂̎@A̓vZXiK𓥂ŉ܂B͂Ả@A邢͉̎񎦂āAŊw񂾂Ƃ̊Tv܂B
͔͂Ƀ_Ci~bNȃvZXłAꂼ̃ViỈ͂ɗp@́Aǎ҂̎@Ƃ͈قȂ邩m܂B͎@͐lꂼłBԑ؂Ȃ̂́A͂̌ʖ肪邩ǍowK邱ƂȂ̂łB܂{͂Ő̑唼́ApPbgXjbt@g킸ɉł邩m܂B߂ăpPbg͂̕@w񂾂ƂApPbg̓eNjbNgĈʓIȖɎgނƂɗ̂ŁAViI񎦂Ă̂łB

pPbgxł̃\[Vlbg[LO
܂2̐lCSNSTCgATwitterFacebook̃gtBbNĂ݂܂傤BeT[rX̔F؃vZX𒲂ׁA2̔ɂ悭SNSǂ̂悤ɈقȂ@gA^XNsĂ邩Ă܂B܂ꂼ̃T[rX̎vȋ@\āAX̊琶ĂgtBbN̂Ȃ闝[߂Ă܂傤B

TwittergtBbNLv`
eNmW[R~jeB̍ŐVj[X𓾂邽߁A邢͔ޏ̋sڂ߂ɂĂATwitter̓C^[lbgłƂ悭pĂT[rX̂ЂƂłBt@Ctwitter_login.pcapɁATwittergtBbÑLv`܂B

@WebTCg̃R[h͕pɂɕς܂B̂ߎ̍̃Lv`ēx쐬悤ƂƁAɎ̂Ƃ͌ʂقȂꍇ܂B

Twitter̃OCvZX
pPbg͂wƂAwɍŏɂĂ炤̂AigĂWebTCgւ̃OCƁÃOCvZX̃gtBbÑLv`łBɂ2̖ړI܂BpPbgʂɂĒmĂ炤̂ƁAlbgsvCeLXg̃pX[hAX̊ǂꂾSłȂɋCtĂ炤߂łB
KɂTwitter̔F؃vZXɂ͂قǖ͂܂B}8-1番悤ɁAŏ3̃pPbǵA[J̃p\Ri172.16.16.128j@ƃ[gT[oi168.143.162.68jAƂTCPnhVFCN\Ă܂B[gT[o443ԃ|[gŐڑ҂󂯂Ă܂BBSSL over HTTPAʂHTTPSƏ̂ZLAȃf[^]@Ɏg|[głBꂾĂASSLgtBbNłƐł܂B

}8-1@nhVFCN443ԃ|[gƐڑ

nhVFCNɑpPbǵAÍꂽSSLnhVFCNłBSSL͌A܂2̃p[eB[Ԃł̒ʐMÍAǂ̂ɎggpĂ܂BnhVFCNvZX̓zXgԂł̌̐ȂƂłƓɁA܂܂ȐڑƈÍ̃lSVG[Vł܂BnhVFCNƁAZLAȃf[^]n܂܂B
f[^ÍꂽpPbgɂ́ApPbgڍׂ̃yCInfoJ[Application Data]ƂĂpPbgTĂB̃pPbgSSLJƁA[Encrypted Application Data]tB[h\A}8-2̂悤ɈÍꂽf[^@܂܂Ă͂łB̓OC̃[U[ƃpX[h̓]Ă܂B

}8-2@ÍꂽMp񂪓]

16Ԗڂ̃pPbgFIN/ACKɂڑ̃eBA_EvZXn܂܂ŁAF؂܂BF؂IƁAuEUTwitter̃z[y[Wւƃ_CNg܂B}8-3ŕ悤ɁA19ԖځA21ԖځA22Ԗڂ̃pPbǵA[gT[oi168.143.162.68jłA443ԃ|[gł͂Ȃ80ԃ|[gŐVȐڑZbgAbvnhVFCNvZXł@BnhVFCNƁA23Ԗڂ̃pPbgWebT[õ[gfBNgi/j߂HTTP GETNGXgs܂ABT[o24Ԗڂ̃pPbgŃNGXgmFBÂ̃pPbgł̃f[^]Jn܂B41Ԗڂ̃pPbg̃RecGETNGXgɊ֘Af[^]̊Ă܂B

}8-3@F؊Twitterz[y[W̃[gfBNgi/jւGETNGXg

z[y[WɊ֘A摜₻̑̃t@C邽߁Aɉ񂩂GETNGXgLv`t@CŎs܂B

cC[gł̃f[^M
OCAx݂͂Ȃ񂪉lĂ邩`ԂłB͖{Mł̂ŁAȂӂɃcC[g܂Bu͎HpPbg͑2ł̂߂̃cC[głvBă|XeBÕgtBbNLv`̂t@Ctwitter_tweet.pcapłB
̃Lv`t@ĆAcC[gMĂ炷n܂Ă܂B[J̃[NXe[V172.16.16.134ƃ[gAhX168.143.162.100Ԃ̃nhVFCNn܂܂B4Ԗڂ5Ԗڂ̃pPbǵANCAgT[o֑ꂽHTTPpPbgō\Ă܂BWireshark͂2̃pPbg̃f[^gݍ킹A₷悤5Ԗڂ̃pPbg̃pPbgڍׂ̃yCɒuĂ܂B
HTTPwb_邽߁A}8-4̂悤5Ԗڂ̃pPbg̃pPbgڍׂ̃yCHTTPJƁAURL /status/updatePOST\bhgĂ̂܂@BzXgtB[htwitter.com̒l܂܂Ă̂ŇAA̓cC[g̃pPbgƂƂɂȂ܂B

}8-4@TwitterAbvf[ĝ߂HTTP POST

}8-5[Line-based Text Data]tB[h@ɏ񂪊܂܂Ă̂ɋCÂł傤B̃f[^͂ƁA[Authenticity Token]ƂtB[hƁAURLɎ̂悤Ȓl܂񂾃Xe[^XtB[h܂B

This+is+a+tweet+for+practical+packet+analysis%2c+second+edition

Xe[^XtB[h̒ĺAÍĂȂvCeLXgőMcC[głB
Ȃɂ̓cC[gꕔ̐lXɂJĂȂl̂ŁAɂ͎኱̃ZLeBʂł̕s܂BƂĒNcC[gǂ߂킯ł͂ȂÃgtBbNMłAcC[g̒gׂČ邱Ƃł̂́Albg[Ñ[U[łB

}8-5@vCeLXg̃cC[g

Twitter̃_CNgbZ[W
x͂̃ZLeBViIlĂ݂܂傤BTwitter̃_CNgbZ[ẂA[U[lIȃbZ[WLł̂łBt@Ctwitter_dm.pcaṕATwitter̃_CNgbZ[W̃pPbgLv`łB}8-6悤ɁA_CNgbZ[W̓vCx[gȂ̂ł͂܂B

}8-6@_CNgbZ[W

}8-67Ԗڂ̃pPbǵARec͂vCeLXgőMĂ邱ƂĂ܂Bقǂ̃Lv`t@C[Line-based Text Data]tB[hł̂̏؋łB
ŕ̂́ATwitter͎͂Ւf̂ł͂Ȃ̂ŁAvCx[gTwitterbZ[Wgďdvȃf[^𑗐M͍̂lAƂƂłB

FacebookgtBbNLv`
xWiresharkgFacebook̃gtBbNLv`A͂Ă݂܂傤B

Facebook̃OCvZX
t@Cfacebook_login.pcapɃLv`AOCvZXn߂܂傤B}8-7̂悤ɁAMp񂪑MƂɃLv`n܂܂BTwitter̃OCvZXƓlɁA443ԃ|[gTCPnhVFCNs܂@B[NXe[V172.16.0.122AAF؃vZXT[o69.63.180.173BƒʐMJn܂BnhVFCNSLLnhVFCNNCAOĈ߂̐Mp񂪑M܂B

}8-7@OC̐MpHTTPSɂăZLAɑM

Twitter̔F؃vZXƂ̈Ⴂ́AOCMp񂪑MꂽƂɁAFؐڑ̃eBA_EɍsȂƂłB̑}8-8ŃnCCgĂ悤ɁA12Ԗڂ̃pPbgHTTPwb_/home.phpGETNGXĝ܂@B

}8-8@F؂̌A/home.phpGETNGXgs

F؂Ɏgڑ́A}8-9̃Lv`t@C̍Ōɂ64Ԗڂ̃pPbg@Ɍ悤ɁAhome.php̃Rec]ƃeBA_E܂B܂80ԃ|[gHTTPڑeBA_Ei62Ԗڂ̃pPbgjAA443ԃ|[gHTTPSڑeBA_E܂B

}8-9@HTTPڑAHTTPSڑeBA_E

Facebook̃vCx[gbZ[W
OCF؃vZX̂Ƃ́AvCx[gbZ[WǂĂ邩Ă܂Bt@Cfacebook_message.pcaɂ́AFacebook̕M҂̃AJEgʂ̃AJEg֑ꂽbZ[WLv`pPbg܂܂Ă܂Bt@CJƃpPbg̐ȂƂɋł傤B
ŏ2̃pPbǵAbZ[Ŵ̂𑗐M邽߂HTTPgtBbN\Ă܂B}8-10̂悤2Ԗڂ̃pPbgHTTPwb_JƁAURLXgOƈꏏPOST\bhgĂ܂@BĂ̂ƂAXgOɂAJAX̎QƂ܂܂Ă܂B

}8-10@AJAXQƂHTTP POST

AJAXiAsynchronous JavaScript and XMLj́AobNOEhŃT[oAC^NeBuWebAvP[V\z邽߂́ANCAgTCh̃Av[`łBvCx[gȃbZ[WNCAg̃uEU֑M΁AZbVʂ̃y[Wւƃ_CNgiTwitter̃_CNgbZ[WƓlɁjƎvm܂񂪁Ał͂܂BAJAXgƂ̂́AX̃y[Wł͂Ȃ̃C^NeBuȃ|bvAbv烁bZ[WMA܂Rec̃_CNg⃊[hsvƂƂӖ܂BꂪAJAX̃bĝЂƂȂ̂łB
}8-11̂悤ɁA2Ԗڂ̃pPbg[Line-based Text Data]J΁AvCx[gbZ[W̒g邱Ƃł܂BTwitterlAFacebook̃vCx[gbZ[WÍꂸɑMĂ悤łB

}8-11@Facebook̃bZ[W̃RecvCeLXg

TwitterFacebook̔r
TwitterFacebookƂ2WebT[rX̔F؂ƃbZ[W̎@AꂼقȂAv[`Ă邱ƂĂ܂BvO}[ȂATwitter̔Fؕ@̂قvIƎ咣ł傤BZLeBT[`[́AׂẴRecmɑMFacebook̎@]邩m܂B܂FؐڑIOɍēxF؂KvȂ߁AԎҍUȂ܂iԎҍUƂ́Aӂ郆[U[2ҊԂł̃gtBbNT󂵂čU邱ƁjBۂɂ́A2̔Fؕ@ɂ͂قƂǍȂ̂łA2l̃vO}[^XNs郋[`JꍇAႢN肤ƂƂ؂Ă܂B
̉͂̃|CǵATwitterFacebookǂ@\邩ł͂ȂAۂɔr\ȃgtBbŇ邱ƂłB{́A悤ȃT[rX܂@\ȂA邢͒xR𒲂ׂ̂ɕKvȘgg݂񋟂Ă͂łB

ESPN.com̃gtBbNLv`
SNS̃`FbNIƁAŐVj[X̌oƃX|[c̓_`FbN̂KƂȂĂ܂B͂ʔȃTCĝłÂ̂ЂƂhttp://www.espn.com/łBhttp_espn.pcapESPNTCguEYgtBbNLv`܂B
̃Lv`t@Cɂ956̃t@C܂܂Ă܂Bꂼ̐ڑƈُʂ̂ɁAt@CŜ蓮ŃXN[Ă̂͂܂ɂςȂ̂ŁAWireshark̉͋@\găvZXȒPɂĂ݂܂傤B

[Conversations]EBhE̗p
ESPÑz[y[Wɂ̃N@\܂܂Ă̂΁Af[^]ɖ1000̃pPbgKvȗR[ł܂Bʂ̃f[^]ꍇAf[^̃\[XmĂƕ֗łAɏdvȂ̂́A\[XЂƂȂ̂Ȃ̂cĂƂłBWireshark[Conversations]EBhEi[Statistics][Conversations]Ij𗘗p΂ꂪ킩܂B
}8-12̗ł́A14IPΘbA25TCPڑA14UDPΘbAC[Conversations]EBhEɏڂ\Ă܂BЂƂ̃TCgƂẮAԂ񂽂̂ƂsĂ܂B

}8-12@̐ڑ\Ă[Conversations]EBhE

[Protocol Hierarchy Statistics]EBhE̗p
̏󋵂ɂ悭邽߁ATCPڑUDPڑŎgĂAvP[VwvgRĂ݂܂傤B}8-13̂悤ɁA[Statitics][Protocol Hierarchy]IA[Protocol Hierarchy Statistics]EBhEJ܂B

}8-13@vgR\[Protocol Hierarchy Statistics]EBhE

TCPAJEg̓pPbg97.07p[Zg߇@AUDPAJEg͎c2.93p[ZgAƂȂĂ܂B\zǂTCPgtBbNHTTPłBAHTTPoRœ]t@C^CvʂɂɕނĂ܂B
WiresharkłHTTP12.66p[Zĝ݂ƕ\Ă̂ŁATCPgtBbNׂ͂HTTPƂƍ邩m܂񂪁Ȃ84.41p[Zg͏TCPgtBbNƂӖȂ̂łif[^]ƃRg[pPbgjBUDPwfBỎ̃GgƁAUDPgtBbNׂ͂DNSłCB
̏񂾂łA̌_o܂BЂƂDNSgUNVɏȂƂƂłBDNSpPbg28̂Łi}8-13[Domain Name Service]Ggׂ̗PacketsJɕł܂jADNSgUNV͍ōł14ƂӖɂȂ܂BNGXgƃX|XňgȂ̂ŁApPbg̑2ŊĂ̐oĂ܂B[Conversations]EBhEUDPwfBỎƁAm14̑ΘbĂāA̐Ƃؖ܂B
DNSNG͓Ǝɑ݂Ȃ̂ŁALv`ɂ邻̑̃gtBbNHTTPgtBbN݂̂łBESPNTCgHTMLR[hDNSő̃hC܂̓TuhCQƂĂ邽߁ÃNGsĂƐł܂B
̘_𗠕t؋TĂ݂܂傤B

DNSgtBbN
tB^쐬΁ADNSgtBbNȒPɌ邱Ƃł܂B}8-14̂悤ɁADNSgtBbNׂĕ\ĂWiresharkEBhẼtB^ɁudnsvƓ͂܂傤B

}8-14@WNGƃX|X̂悤ɌDNSgtBbN

}8-14DNSgbŃANGƃX|X̂悤Ɍ܂BꂽDNS悭ɂ́ÃNĜ݂\悤tB^쐬܂BtB^쐬ɂ́ApPbgꗗ̃yCŃNGIApPbgڍׂ̃yCŃpPbgDNSwb_J܂B[FlagsF0x0100iWNGj]tB[hENbNA[Apply as Filter]Ƀ}EXĂA[Selected]I܂B
dns.flags == 0x0100tB^NăNG\悤ɂȂ̂ŁA͂ĂL^Ɠǂ݂₷Ȃ܂B܂}8-14悤ɃNG14iepPbgNG\ĂjAׂẴhCESPNA܂̓z[y[Wɕ\RecɊ֘AĂ̂܂B

HTTPNGXg
ŌHTTPNGXg𒲂ׁÃNG̃\[X؂܂B̂߂ɂ[Statistics][HTTP]J[Requests]IA[Create Stat]NbN܂isOɁA쐬΂̃tB^NAɂ̂YꂸɁjB
}8-15[HTTP Requests]EBhEĂ܂Bɕ\Ă14̐ڑ́ieshCւ̐ڑ\Ă܂jADNSNGɂĂ܂Ƃ߂Ă܂B

}8-15@EBhEɂ܂Ƃ߂ꂽׂĂHTTPNGXgBANZXꂽhC\B

ꂾ̐ڑNĂƁAւ̐[vZXǂꂩvɔf̂xXgłBƂȒPȂ̂̓gtBbÑT}[݂邱ƂłB[Statistics][Summary]I܂傤B}8-16Ɏ[Summary]EBhEAvZXŜ2bŕ\Ă܂@B
Weby[WƂȒPȃNGXg14̈قȂhCƃTuhCւ̃NGXgւƕA܂܂ȃT[oƐڐGAł̃vZXŜ2bĂȂƂ͕̂svcȊ܂B
Cɓ̃TCg֖K₵̃gtBbNLv`Â悤ɉ͂Ă͖̂ʔKɂȂ܂BpPbgȂAf[^ǂ痈Ă̂͂킩Ȃ̂łB

}8-16@[Summary]EBhEvZXŜ2bȓɕ\Ă

ł̖
x͖̂gtBbN̗Ɉڂ܂B܂܂ȃC^[lbgANZXƁAsȃv^xЂ̐ڑ̖ȂǁAT^IȖĂ܂傤B

C^[lbgɐڑłȂFݒ
[U[C^[lbgɐڑłȂƂ̂Aŏ̃ViIłB̃[NXe[VƂ̋LA[JT[oŃzXgĂAvP[Vւ̃ANZX܂ށAlbg[Ñ\[XɃANZXł邱Ƃ͊mFĂ܂B
ׂẴNCAgƃT[oXCb`oRŐڑĂ邱Ƃ킩悤ɁAlbg[NA[LeN`͂ȂPȍɂȂĂ܂BC^[lbgڑ̓ftHg̃Q[gEFCƂċ@\ЂƂ̃[^oRŏAIPAhXDHCPɂĒ񋟂܂BK͂ȃItBXł͔ɈʓIȃViIłB

P[uɂ肱
̌𔻒f邽߁A[U[ɃC^[lbguEYĂĂŒɁAXjbt@g܂By[Wiۂ̃y[Wj̏gi}2-15jAXjbt@zûɓK؂ȏꏊ𔻒f܂B
̃lbg[ÑXCb`̓|[g~[OɑΉĂ܂BeXg̎{̂߂ɂłɃ[U[̎זĂ܂Ă̂ŁAēxItCɂȂ̂䖝Ă炢܂傤B̌ʂ̃t@Cnowebaccess1.pcapłB


gtBbÑLv`́A}8-17̂悤ɁAARPNGXgƃX|XŎn܂܂BMACAhX00:25:b3:bf:91:eeAIPAhX172.16.0.8̃[U[Rs[^́A1Ԗڂ̃pPbgŁÃftHg̃Q[gEFCł172.16.0.10IPAhXɊ֘AMACAhX邽߂ɁAlbg[NZOĝׂẴRs[^ARPu[hLXgpPbg𑗐M܂B

}8-17@ftHgQ[gEFC߂ARPNGXgƃX|X

2Ԗڂ̃pPbg2ŃX|X󂯎[U[Rs[^́A172.16.0.1000:24:81:a1:f6:79ł邱Ƃ킩̂ŁAQ[gEFCւ̃[g܂B
ARPX|XɑARs[^͇BԖڂ̃pPbgDNSgAIPAhX疼O݂Kv܂B}8-18Ɏ悤ɁAvC}DNST[oł4.2.2.2DNSNGpPbg𑗐M܂@B

}8-18@4.2.2.2ɑMꂽDNSNG

ʂ̏󋵂ƁADNST[oDNSNGɔɐvɉ܂Ał͂ȂĂ܂Bł͂ȂADNSNGēxʂ̃AhXւƑMĂ܂B}8-19ł́A4Ԗڂ̃pPbg2ڂDNSNGAZJ_DNST[o4.2.2.1ɑMĂ܂@B

}8-19@2ڂDNSNG4.2.2.1ɑM

܂DNST[ỏ͂ȂANG1bɍēxA4.2.2.2ւƑM܂B̃vZX͐}8-10番悤ɁAvC}DNST[o@ƃZJ_Aւƌ݂ɃpPbg𑗂Ƃ`ŁAbԌJԂ܂BvZXŜɂ鎞Ԃ͖8bŇBAꂪ[U[̃uEUAWebTCgɐڑłȂƕ񍐂܂łɂ鎞ԂƂȂ܂B

}8-20@ʐM~܂DNSNGJԂ

pPbgƂɁǍ肵܂傤B܂AftHg̃Q[gEFCƍlĂ郋[^ւARPNGXgĂ邱ƂA̒ʐM@̓ICłAʐM\Ƃ킩܂B܂[U[̃Rs[^͎ۂɃpPbg]Ă̂ŁARs[^̂ɃvgRX^bN̖͂ȂƐł܂B͖炩ɁADNSNGXgsꂽ_ŋNĂ̂łB
ł́ADNSNG̓C^[lbg̊OT[oi4.2.2.2܂4.2.2.1jɂĉ܂B܂𐳂ɂ́A[^DNSNGT[oւƓ]AT[oɉKv̂łBWeby[Ŵ̂̃NGXgHTTPpOɂ炪sȂ΂Ȃ܂B
lbgɐڑłȂ[U[ɂ݂͑Ȃ̂ŁAlbg[N[^ƃ[gDNST[o͂炭̌ł͂ȂƂ܂BƗB^킵̂A[U[̃Rs[^łB
̃Rs[^ڂׂĂ݂ƁADHCP蓖ĂAhX󂯎炸ɁA蓮ŃAhX񂪐ݒ肳Ă߁AftHg̃Q[gEFCAhXݒ肪sɂȂĂ邱Ƃ܂BftHgQ[gEFCƂĐݒ肳ꂽAhXȂ߁ADNSNGpPbg]łȂ̂łB

w񂾂
̃ViÍ̖ANCAg̐ݒ~Xɂ܂B莩̂͂ȂPȂ̂łA[U[ɗ^e͑łB̂悤ȒPȐݒ~X̃guV[eBOłAlbg[Nm̂ȂlAƂpPbg͂s\͂Ȃ΁AȎԂĂ܂܂BK͂̑傫ȕGȖ邾ApPbg͂ł͂Ȃ̂łB
̃ViIł́AQ[gEFC[^IPAhXĂȂ̂ŁAWireshark͖𐳊mɎʂł܂łAǂ`FbNׂĂꂽ߁AMdȎԂߖł܂BQ[gEFC[^𒲂ׁAISPɘAA[gDNST[õguV[eBOs\[XTƂȂǍłp\R̂̂ɏW邱Ƃł̂łB

@lbg[NIPAhXXL[ɊĂƁA͂ɑs悤ɂȂ܂BARPNGXgMꂽIPAhXQ[gEFC[^̃AhXƈႤƋCÂ΁A̖͂Ɏʂł̂łBPȐݒ~X͂΂΃lbg[N̍ƂȂ܂ApPbg͂sŒʏ͊ȒPɉł܂B

C^[lbgɐڑłȂF]܂Ȃ_CNg
̃ViIłA[NXe[VC^[lbgɐڑłȂ[U[ɍēxoꂵĂ炢܂傤BȂقǂƂ͈قȂAx̃[U[̓lbgɂ͐ڑł̂łÃz[y[Włhttp://www.google.com/ɐڑłȂ̂łBGooglezXghCɃANZX悤ƂƁAuInternet ExplorerWeby[W\ł܂vƂy[WɃ_CNgĂ܂܂B肪NĂ̂͂̃[U[łB
قǂ̃ViIlA̊ȒPȃXCb`ƁAftHgQ[gEFCƂċ@\郋[^1݂̂ō\ꂽȃlbg[NgĂ܂B

P[uɂ肱
͂n߂邽߁A[U[ɂhttp://www.google.com/uEYĂ炢A^bvgĐgtBbN҂󂯂܂B̌ʂ̃t@Cnowebaccess2.pcapłB


gtBbÑLv`́A}8-21̂悤ɁAARPNGXgƃX|XŎn܂܂BMACAhX00:25:b3:bf:91:eeAIPAhX172.16.0.8̃[U[Rs[^́A1Ԗڂ̃pPbgŁAzXgIPAhX172.16.0.102Ɋ֘AMACAhX邽߂ɁAlbg[NZOĝׂẴRs[^ARPu[hLXgpPbg𑗐M܂B̃AhXɔF邱Ƃ͂ł܂łB

}8-21@lbg[N̕ʂ̋@ւARPNGXgƃX|X

2Ԗڂ̃pPbgŁAIPAhX172.16.0.102A00:21:70:c0:56:f0łƕ܂Bقǂ̃ViIlA̓Q[gEFC[^̃AhXƂApPbg͂̃AhXgĊODNST[oɍēx]ƐĂ݂܂傤BƂ낪}8-22ƁÃpPbgDNSNGXgł͂ȂA172.16.0.8172.16.0.102ւTCPpPbgłBSYNtOZbgĂƂƂ́A2̃zXgԂŐVTCPڑs߂̃nhVFCŃAŏ̃pPbgƂƂɂȂ܂@B

}8-22@zXgʂ̓zXgւƑꂽTCP SYNpPbg

܂172.16.0.102Bł́AʏHTTPgtBbNɎg80ԃ|[gTCPڑ݂̎sĂ܂AB}8-23Ɏ悤ɁA̐ڑ݂̎́AzXg172.16.0.102RSTACKtOZbgTCPpPbgi4Ԗڂ̃pPbgj@ƂđMۂɁAˑR~Ă܂B
6͂ŁATCPڑÎɁARSTtOZbgpPbggƂvoĂBȂ獡̃ViIł́A172.16.0.8̃zXǵA172.16.0.102̃zXg80ԃ|[gTCPڑm悤Ƃ܂BƂ낪̃zXgł́A80ԃ|[gŃNGXg҂󂯂T[rXݒ肳ĂȂ߁ATCP RSTpPbgĐڑIĂ܂̂łB̃vZX2JԂĂ܂B}8-24̂悤ɁAʐMSɏI܂łɁA[U[̃Rs[^SYNARSTZbgꂽX|X߂Ă邩łBŃ[U[̃uEUɂ́Ay[W\ł܂ƂbZ[W\܂B

}8-23@TCP SYNւ̉ƂđꂽTCP RSTpPbg

}8-24@TCP SYNRSTpPbg͍v3񑗂Ă

Ƌ@\ĂЂƂ̃lbg[N@̐ݒ𒲂ׂƁA1Ԗڂ2Ԗڂ̃pPbgARPNGXgƃX|Xɖ肪\ɋCÂ܂BARPNGXgQ[gEFC[^MACAhXł͂ȂAق̕sȋ@ɑĂ̂łBARPNGXgƃX|XǐՂ΁Awww.google.comɊ֘AIPAhX邽߂ɁADNST[oɑMDNSNGƎv̂łA܂BDNSNG̐W闝R2܂B

EڑJnʐM@̃hCIPAhXłDNSLbVɃ}bvĂB
EhCɐڑĂʐM@̃hCIPAhX̃zXgt@CɂłɃ}bsOĂB

NCAg̃Rs[^ɒׂĂ݂ƁARs[^̃zXgt@CɁAIPAhX172.16.0.102ƌтwww.google.com̃Gg܂B[U[̖͂̊ԈGgɂ̂łB
Rs[^͈ʂɁAhCIPAhX̃}bsO̐ȏ񌹂ƂăzXgt@C𗘗pAO\[Xɖ₢킹Oɂ̃t@C`FbN܂B̃ViIł́A[U[̃Rs[^̓zXgt@C`FbNAwww.google.com̃GgAwww.google.com̓[Jlbg[NɂƔf܂BARPNGXgzXgɑăX|X󂯂ƂA172.16.0.10280ԃ|[gTCPڑ悤Ƃ̂łB[gVXeWebT[oƂĐݒ肳ĂȂ߁Aڑ܂łB
zXgt@C̃Gg폜ƁA[U[̃Rs[^͐ʐMJnAwww.google.comɐڑł悤ɂȂ܂B

@WindowsVXeŃzXgt@C𒲂ׂɂ́AC:\Windows\System32\drivers\etc\hostsJ܂BLiux̏ꍇview/etc/hostsJ܂B

͔ɂ悭N܂BӂR[hߍ܂ꂽWebTCgɃ[U[_CNĝɉN̊ԎgĂ}EFAp̂łBU҂zXgt@C𑀍삵AICoLOփANZXƁA𓐂݂UTCgփ_CNgĂƂǂł傤I

w񂾂
gtBbN̉͂𑱂ĂƁA܂܂ȃvgR̋@\ƁA̎Ւf̎d̗wт܂B̃ViIł́AO̐ݒ~Xł͂ȂANCAg̐ݒ~X̂߂ɁADNSNGM܂łB
pPbgxł̖𒲂ׂƁAIPAhXsȂƁA܂ʐMvZX̌ƂȂDNSȂƂ܂B̏ɂāANCAǧłƔ̂łB

C^[lbgɐڑłȂFAbvXg[
2̃ViIlÃViIłA[U[[NXe[VC^[lbg֐ڑłȂƕĂ܂B̃[U[͖̌ЂƂWebTCgAhttp://www.google.com֍i荞݂܂BɒׂĂ݂ƁA̖肪gDŜɉeĂ邱Ƃ܂BNGooglehCփANZXłȂ̂łB
2̃ViIƓ悤ɁÃlbg[N̃XCb`ƁAC^[lbgւƂȂ1̃[^ō\Ă܂B

P[uɂ肱
̃guV[eBÔ߂ɁA܂http://www.google.comuEYăgtBbN𐶐܂B̓lbg[NŜɍLĂA܂K͂ȃ}EFẢ\邽߁ÃRs[^璼ڃXjbtBO邱Ƃ͂ł܂B̂悤ȏ󋵂ɒuꂽꍇA^bvŗǂ̑IƂȂ܂BT[rX񒆒fꂽ̂ASɎ󓮓IȏԂɂȂ邽߂łB^bvɂLv`̃t@Cnowebaccess3.pcapłB


̃pPbgLv`́AARPgtBbNł͂ȂDNSgtBbNŎn߂܂Bŏ̃pPbg͊OAhXŁA2Ԗڂ̃pPbgɂ͂̃AhX̉܂܂Ă̂ŁAARPvZX͂łɎn܂ĂāAQ[gEFC[^MACIPAhX}bsO͂łɃzXg172.16.0.8ARPLbVɑ݂ĂƉł܂B
}8-25Ɏ̂AzXg172.16.0.8AhX4.2.2.1֍ŏɑꂽpPbg̃Lv`@ŁADNSpPbgłABpPbg̃Rec𒲂ׂƁAwww.google.comAR[h̃NGł邱Ƃ킩܂BB

}8-25@www.google.comAR[hDNSNG

4.2.2.1̃NGւ̃X|XA}8-262Ԗڂ̃pPbgłBpPbgڍׂ̃yC𒲂ׂƁÃNGXgɉl[T[oANGɑ΂̉񓚂񋟂Ă邱Ƃ܂@B̎_܂łׂ͂ėǍDŁAʐM؂ȂsĂ܂B

}8-26@AR[hDNSX|X

[U[̃[NXe[VWebT[oIPAhXmF̂ŁAT[oƂ̒ʐM݂̎\ɂȂ܂B}8-27̂悤ɁÃvZX172.16.0.874.125.95.105֑ꂽ3Ԗڂ̃pPbgATCPpPbgŎn܂܂@B2Ԗڂ̃pPbgɁADNSNGX|XŒ񋟂ꂽAŏAR[ḧAhX܂܂Ă܂BTCPpPbgɂSYNtOZbgĂAA[gT[o80ԃ|[gł̒ʐM݂Ă܂BB

}8-27@80ԃ|[gł̐ڑJn݂SYNpPbg

TCPnhVFCNvZXȂ̂ŁAƂTCP SYN/ACKpPbg߂͂łAƕʂSYNpPbgAM父ւƑĂ܂B}8-28Ɏ悤ɁÃvZX͖1bɍēxNĂAŒʐM~AuEUWebTCgȂƕ񍐂Ă̂łB

}8-28@ȂTCP SYNpPbg3xMĂ

4.2.2.1̊ODNST[oւDNSNGĂ邱ƂAlbg[Ñ[NXe[VOɐڑł͕̂Ă܂BDNST[ỏɊ܂܂AhXLŁAzXg͂̃AhX̂ЂƂւ̐ڑ݂Ă܂B܂ڑɗpĂ郍[J[NXe[V@\Ă悤łB
Ȃ̂́A[gT[oڑNGXgɓȂA܂TCP RSTpPbgMȂƂłBɂ͂̗Rl܂BWebT[o̐ݒ~XAWebT[õvgRX^bN̋@\sSA邢̓[glbg[ÑpPbgtB^it@CAEH[jȂǁB[J̃pPbgtB^͂ȂƉ肷ƁAق̖̉\̓[glbg[NɂƂƂɂȂAグƂȂ܂B̏ꍇWebT[o@\Ă炸Aڑ݂̎܂܂łBGoogleŖ肪΁AʐM\ɂȂ܂B

w񂾂
̃ViÍ̖A瑤ł͏CłȂ̂łB͂̌ʁA̓lbg[ÑzXgłA[^łAOT[rX񋟂ODNST[ołȂƔ̂łB
̌ɂȂƕƁAXgXy邾łȂAǗɕꂽƂɑ̖ʂ~܂B̂ȂƎ咣ISPx_A\tgEFAЂƉxPJĂ܂ÂƂApPbg͉R܂B

sȃv^
ITwvfXNǗAɂĂĂ܂BZ[̃[U[́AZ[XŎgĂv^ɖ肪ƕ񍐂Ă܂Bʂ̃v^Wu𑗂ƁAy[WŒ~Ă܂Ƃ܂BhCoݒxςĂ݂܂A܂܂łBwvfXNX^bt͂ꂪlbg[Nł͂ȂǂAmFĂقƌĂ܂B

P[uɂ肱
̓v^̖Ȃ̂ŁAł邩v^ɋ߂ƂɃXjbt@ݒ肷邱Ƃn߂܂Bv^{̂ɂWiresharkCXg[ł܂񂪁Albg[NŎgpĂ͍̂ŐV^̃C3XCb`Ȃ̂ŁA|[g~[Og܂Bv^ڑĂ|[g󂢂Ă|[gփ~[AWiresharkCXg[ꂽRs[^̃|[gւȂ܂Bݒ肪Av^ɑʂ̃v^Wu𑗂Ă炢Ao͂Ď܂BLv`t@Cinconsistent_printer.pcapłB


}8-29킩悤ɁAlbg[N[NXe[VԂTCPnhVFCNv^Wu𑗂i172.16.0.8jAv^i172.16.0.253jLv`t@C̓Őڑn߂Ă܂BnhVFCNɑA1460oCgTCPpPbgv^ɑ܂@Bf[^ʂ́ApPbgꗗ̃yCInfoJ̈ԉE[ApPbgڍׂ̃yCTCPwb_̈ԉŊmFł܂B

}8-29@TCPŃv^ɓ]ꂽf[^

}8-30̂悤ɁA4Ԗڂ̃pPbgɑA1460oCg̃f[^܂񂾂ЂƂ̃pPbg@Av^ɂĔF܂AB

}8-30@ȃf[^]TCPɂF

Ō2̃pPbg܂ŁAf[^̃t[܂B121Ԗڂ̃pPbgTCPđpPbgŁA}8-31悤ɁAꂪgu̍ŏ̃TCłB

}8-31@TCPđpPbg͖̒

ʐM@킪[g@ւTCPpPbg]̂ɁÃ[gpPbg]FȂꍇATCPđpPbg܂Bđ臒lɒBƁAM̓[g@킪f[^MĂȂƔfApPbgđ܂B̃vZX͒ʐM~܂ŐJԂ܂B
̃ViIł́Av^Mꂽf[^FłȂ߂ɁANCAg̃[NXe[Vv^ɍđpPbg𑗂Ă܂BTCPwb_SEQ/ACK͕JẢ̒ǉ΁i}8-31j@AꂪȂđȂ̂̏ڍׂ킩܂B121Ԗڂ̃pPbg120Ԗڂ̃pPbg̍đłBB܂đpPbg̍đ^CAEgiRTOj͖5.5błAB
pPbgԂ̒x͂ƂA󋵂ɍ킹Ďԕ\tH[}bgς邱Ƃł܂Bł͐̃pPbgMꂽ̂Aǂ̂炢oĂđꂽ̂ŁA[View][Time Display Format]IсA[Second Since Previous Captured Packet]Iт܂i}8-31jBƃIWĩpPbgi120Ԗڂ̃pPbgjMĂ5.5b121Ԗڂ̃pPbgđĂ̂͂蕪܂@B

}8-32@pPbg̑MԊumƃguV[eBOɖ𗧂

̃pPbg120Ԗڂ̃pPbg̍đłB̃pPbgRTO11.10bŁAɂ͐قǂ̃pPbgRTOł5.5b܂܂Ă܂BpPbgꗗ̃yCTimeJ΁A̍đ5.6bɂ̍đsĂ̂܂B̓Lv`t@C̍Ō̃pPbgłA܂v^قړɈ~Ă܂B
̃ViIł́Ãlbg[Ñ[NXe[Vƃv^Ȃ̂ŁAǂɖ肪邩𔻒f邾ōς݂܂B΂炭̊ԃf[^̗ώ@ƁA鎞_ŁAv^[NXe[Vւ̉~Ă̂ɋCÂ܂Bđ悤ɁA[NXe[V̓f[^𑗐M悤ƍőP̓w͂Ă܂Av^߂Ă܂Ă̂łBǂ̃Rs[^v^Wu𑗂낤Ƃ̖͔̂ŁAv^ɌƉ肵܂B
ɉ͂ƁAv^RAMɈُ𔭌܂Bʂ̃v^WuĂ̐y[WȂ̂́Äꕔ̗̈ɃANZXĂ\܂Bł̓ɂāAv^Vf[^󂯎邱ƂłAzXgɂv^Wu̒ʐM~߂Ă܂Ă̂łB

w񂾂
̃v^̓lbg[Nł͂܂񂪁AWiresharkgČ邱Ƃł܂B܂ł̃ViIƂ͈ႢATCPgtBbN݂̂ƂĂ܂BKȂ̂TCPA2̋@킪ʐM߂Ă܂ƂLvȏcĂꂽƂłB
͒ʐMˑR~ƂATCPđ@\̂ŁẢӏ𐳊mɎwE邱Ƃł܂B蕡GȖꍇłÂ悤ȋ@\ɗ邱ƂpɂɋN܂B

x
̃ViIɓoꂷ̂́A{ЂƁAVɐݗꂽ΂̎xЂƂłB̊ƂITCt̂قƂǂ{ГɂAWindowsT[ox[X̃hCƁAZJ_̃hCRg[̗pĂ܂BhCRg[́AxЂDNSƔF؃NGXgĂ܂BhCRg[̓ZJ_DNST[oŁA{ЂDNST[oA\[XR[h󂯎悤ɂȂĂ܂B
fvCgS`[xЂɐVCt̓sہAlbg[ÑCglbgWebAvP[VT[oɒNANZXłȂƂ܂B̃T[o͖{ЂɂAWANoRŃANZX悤ɂȂĂ܂BxЂ̎ЈSANZXłȂ̂łAȂ̂͂T[ô݂ŁAC^[lbgƎxЂ̂ق̃\[Xɂ̓ANZXł̂łB
}8-33͍̃ViIɓoꂷ@Ă܂B

}8-33@WIȎxЂ̃lbg[N̍\@
x
[NXe[V@172.16.16.101
xЂ̃[^
xЂ̃X[uDNST[o@172.16.16.251

WAN

{
{Ђ̃[^
{Ђ̃AvP[VT[o@172.16.16.200
{Ђ̃}X^[DNST[o@172.16.16.250

P[uɂ肱
͖{ЂƎxЊԂ̒ʐMɂ̂ŁA̒ǐՂn߂邽߂ɂ̏ꏊŃf[^W܂BxЂ̃NCAgɖ肪\lāARs[^̂1|[g~[O邱Ƃn߂܂傤BWAgăf[^Wق̏ꏊ߂܂BNCAgWŏ̃Lv`t@Cstranded_clientside.pcapłB


}8-34̂悤ɁAAhX172.16.16.101̃[NXe[Ṽ[U[A{Ђ̃AvP[VT[o172.16.16.200ŃzXgĂAvP[VɃANZX悤ƂƂAŏ̃Lv`t@Cn܂Ă܂B̃Lv`ɂ2̃pPbg܂܂Ă܂Bŏ̃pPbgɓĂ̂́AappserverBAR[hA߂172.16.16.251ɑꂽDNSNGXg@̂悤łB͖{Ђ172.16.16.200ɂT[oDNSłB
}8-35番悤ɁÃpPbgւ̉T[oQ@ŁADNSNGɖWƂĂ܂BG[iT[oQĵ߁ÃpPbg̓NGɉ񓚂Ă܂AB
ŒʐMDNSɉ炩̊֌W邱Ƃ킩܂BxЂDNSNG172.16.16.251DNST[oŉ̂ŁAꂪ̃|CgƂȂ܂B

}8-34@appserver@AR[hDNSNGŎn܂ʐM

}8-35@NGX|XAbvXg[Ă

xЂDNST[oK؂ȃgtBbNLv`邽߁AXjbt@ݒuA|[g~[O̐ݒύXāA[NXe[ṼgtBbNł͂ȂT[õgtBbN~[悤ɂ܂B̌ʂ̃t@Cstranded_branchdns.pcapłB
}8-36̂悤ɁÃLv`̓NGƃX|XAĂЂƂ̃pPbgŎn܂Ă܂B̒ǉ̃pPbg͂ƖȊłBWDNST[o53ԃ|[gAŖ{Ђ̃vC}DNST[oi172.16.16.250j@Ƃ̒ʐM݂Ă܂AUDPł͂ȂłBB
̃pPbg̖ړImɂ́A7͂DNS̐voĂBDNS͒ʏUDPg܂ANGւ̃X|XTCY𒴂ꍇATCPg܂B̏ꍇAŏUDPgtBbNTCPgtBbNNĂ悤łBTCP͂܂][]A܂胊\[XR[hDNST[oԂœ]ۂɂg܂ÃP[X͂̂悤łB

}8-36@SYNpPbg53ԃ|[ggĂ邪UDPł͂Ȃ

xЂɂDNST[o͖{ЂDNST[õX[uA܂胊\[XR[h󂯎̂ɖ{ЃT[oɈˑĂ邱ƂɂȂ܂BxЂ̎ЈANZX悤ƂĂAvP[VT[o͖{ЂɂA{ЂDNST[õT[oǗĂ܂BxЃT[oAvP[VT[oւDNSNGXgɂ́ÃT[oDNS\[XR[hA{DNST[oxDNST[oւƓ]Ȃ΂Ȃ܂BLv`t@CSYNpPbgĂ̂͂̂߂ƍl܂B
SYNpPbgɉȂ̂́AłDNS肪AxЂƖ{ЂDNST[oԂł̃][]Qɂ邩łB][]sR邱ƂŁA1iKi݂܂傤BƐl̓ItBXԂ̃[^A{ЂDNST[ô̂łƂƂ܂ōi荞߂܂B{DNST[õgtBbNXjbtāASYNpPbgT[o֑Ă邩ǂĂ݂܂B
{DNST[ogtBbÑLv`t@C͂܂BgtBbN݂ȂłBSYNpPbg̓T[o֓͂ĂȂ̂łBZp҂𑗂Ė{ЂƎxЂȂ[^̐ݒmFĂƂA{Ѓ[^53ԃ|[gł̓CoEhUDPgtBbN݂̂ATCPgtBbN͋ۂ悤ݒ肳ĂƂ܂BPȐݒ~XAT[oԂ̃][]WQAxЂ̃NCAg{ЂNG̉󂯎ȂĂ̂łB

w񂾂
ƍ߃h}΁Albg[NʐM̑{ɂĂȂwKł܂Bƍ߂NƁAY͂܂Q҂̎ނɒ肵܂BŎ肪𓾂āAɒƂƂAƐl܂ő̂łB
̃ViIł́AQҁi[NXe[Vj̒n߁ADNSʐM邱Ƃŉւ̎肪𓾂܂B̎肪肩AxЂDNST[oA{Ђ̃T[oAŏIIɂ͖̌ł郋[^܂łǂ̂łB
͂sꍇApPbgqgƍl悤ɂ܂傤Bqg͒N߂Ƃ͋Ă܂񂪁AŏIIɂ͔Ɛl܂œĂ܂B

CCJ
ITƊEł́AJ҂ƃVXeǗ҂イ_Ă܂BJ҂͂AvO̕s́Albg[N̎蔲ݒƋ@̋@\sŜƕĂ܂BVXeǗ҂́Albg[NG[ƒʐM̒x̓R[hɖ肪ƔĂ܂B
̃ViIł́AJ҂A̓X܂̔グǐՂAf[^x[Xւƕ񍐂߂AvP[VJƂ܂傤Bʏ̉cƎԒ̑шZ[ûŁA̓A^CAvP[Vł͂܂B񍐃f[^͓~ςAԂCSVt@CƂĒf[^x[Xɑ}܂B
Ƃ낪̐VJ̃AvP[V@\܂BX܂瑗ꂽt@C̓T[oMĂ܂Af[^x[Xɑ}f[^ɖ肪̂łBڂAf[^̈ʒuɊԈႢASɔĂf[^܂BvO}[lbg[Nɖ肪Ƃ̂ŁAVXeǗ҂͘TĂ܂BvO}[́At@CX܂璆f[^|Wg֓]rŏĂ̂ɊԈႢȂƌ̂łBނ̊ԈႢؖ̂A̖ڕWłB

P[uɂ肱
Kvȃf[^W邽߁AX܂̂ЂƂA܂͖{ЂŃpPbgLv`܂Bׂ͂Ă̓X܂ɉeĂ̂ŁAlbg[Nɖ肪ƂAׂĂ̓X܂ɗBꋤʂXbhłA{ЂŔĂ͂łB
lbg[NXCb`̓|[g~[OɑΉĂ̂ŁAT[oڑĂ|[g~[AgtBbNXjbt܂BLv`gtBbN1X܂̒PƃCX^XւƕāAT[oւCSVt@CAbv[h܂B̃Lv`t@Ctickedoffdeveloper.pcapłB


vO}[JAvP[VɂẮA܂m܂BLv`t@CFTPgtBbNŎn܂Ă悤Ȃ̂ŁAꂪۂɃt@C]Ă郁JjYȂ̂ǂ𒲍܂BʐM܂Ƃ߂Ă݂ɂ́AʐMt[Ot֗łB[Statistics][Flow Graph]IA[OK]NbN܂傤B}8-37̃OtłB

}8-37@t[OtFTPʐMЂƂ߂ŕ

̃t[OtƁA172.16.16.128172.16.16.121Ƃ̊ԂFTPڑݒ肳Ă܂@B172.16.16.128ڑJnĂ̂ŇAꂪNCAgŁA172.16.16.121̓f[^RpCďT[oƐł܂Bt[OtÃgtBbNFTPvgR݂̂gĂ邱ƂmFł܂B
ł̃f[^]sĂ͂Ȃ̂ŁAFTP̒mgāA]n܂ĂpPbg̏ꏊ܂BFTPڑƃf[^]̓NCAgn܂̂ŁAFTPT[oւ̃f[^Abv[hɎgpAFTP STORR}hT܂傤B̂߂ɂ̓tB^ݒ肷̂ԊȒPłB
̃Lv`t@CɂFTPNGXg̃R}hUĂ̂ŁAGNXvbVr_ŐS̃vgRIvV\[ĝł͂ȂApPbgꗗ̃yC璼ڃtB^\z܂Bɂ͂܂AFTPNGXgR}ĥpPbgIKv܂BXg̏㕔ɋ߂̂ŁA5Ԗڂ̃pPbgIт܂傤BɃpPbgڍׂ̃yC[FTP]JA[USER]J܂B[Request Command: USER]tB[hENbNA[Prepare a Filter]IAŌ[Selected]Iт܂B
FTP USERNGXgR}h܂ނׂẴpPbgtB^ɂAtB^_CAOɋL^鏀ł܂Bx͐}8-38̂悤ɁAUSERSTORɒuāAtB^ҏW܂@B

}8-38@̃tB^̓f[^]n܂ꏊʂ̂ɖ𗧂

ENTERătB^LɂƁA64Ԗڂ̃pPbgɂ́ASTORR}h̃CX^X1݂ĂȂ̂킩܂AB
f[^]̎n܂ꏊ̂ŁApPbgꗗ̃yC㕔[Clear]{^NbNāAtB^܂B
64Ԗڂ̃pPbgŎn܂Lv`t@C𒲂ׂƁÃpPbgt@Cstore4829-03222010.csv̓]w肵Ă̂܂i}8-39jB

}8-39@FTPgē]CSVt@C

STORR}hɑpPbg͈قȂ|[ggĂ܂AFTP-DATA]̈ꕔƎʂĂ܂Bf[^]ꂽ̂͊mF܂AvO~O̊ԈႢ͏ؖłĂ܂BLv`pPbg]ꂽt@C𒊏oāAlbg[Nړ̂t@C̃Reĉ܂܂ł邱ƂKv܂B
t@CÍȂtH[}bgœ]ƁAZOgɕāAőgݗĂ܂B̃ViIł́AɓǁA܂gݗĂĂȂpPbgLv`Ă܂Bf[^ׂ͂đĂ̂ŁAt@Cf[^Xg[ƂĒoAgݗĂ邾łBgݗĂɂ́AFTP-DATAXg[ɂpPbgi66Ԗڂ̃pPbgȂǁjIсA[Follow TCP Stream]NbN܂BƐ}8-40̂悤TCPXg[ɕ\܂B
f[^FTPvCeLXg̏Ԃœ]Ă悤łAt@CȂ̂̓Xg[̂Ȃ̂ǂ͊mł͂܂Bf[^gݗĂƃIWĩtH[}bgŒoł̂ŁA[Save As]{^NbNA}8-41̂悤64Ԗڂ̃pPbgɕ\t@Cw肵܂B[Save] NbNĂB

}8-40@f[^̓]ԂTCPXg[

}8-41@Xg[IWĩt@Cŕۑ

ۑsƁAi[VXeŏɓ]t@CƂ܂oCgxCVSt@Cł͂łBIWit@CMD5nbVƒot@C̃nbVrΌ؂ł܂B}8-42̂悤ɁAMD5nbVɂȂ͂łB
t@Cr΁AAvP[VŋNĂf[^x[XQ̌lbg[NłȂƂؖł܂Bi[VXeRNVT[o֓]t@ĆAT[oɂ͑Ȃ̂ŁA̓AvP[Vt@CĂԂɋNƂɂȂ܂B

}8-42@IWit@Cƒot@CMD5nbV͓

w񂾂
pPbgx̉͂΂炵̂́AႲႵAvP[VɑΏȂčςޓ_łBDꂽ̂A肪GȃAvP[V̂ق͂邩ɑ̂łApPbgxł͖ɂȂ܂BvO}[̓AvP[VˑĂsvcȃR|[lgɂĐSz܂ASs̃R[hgGȃf[^]AǂFTPTCPA邢IPɉ߂Ȃ̂łB{vgR̒m𗘗p΁AʐMvZXĂ̂mFAt@C𒊏oălbg[ŇSؖ邱Ƃ\łB肪ǂقǕGɌƂĂA傹̓pPbgɉ߂ȂƊoĂ܂傤B

܂Ƃ
{͂ł́ApPbg͂ɂĒʐM̖肪藝ł{IȃViIɋ܂BʓIȃvgR̊{͂g΁Albg[NǐՂA^C~O悭ł̂łB܂ViIɂ͒ʂȂł傤AŏЉ̓eNjbŃAƎ̖̉͂ɖ𗧂͂łB

