=== ch03.docx
[chap]3́@WiresharkTv

1͂ŐGꂽ悤ɁApPbg͂ɎgXjbt@ɂ͂܂܂Ȏނ܂A{łWiresharkグĂ܂B̏͂łWireshark̊Tv܂B

Wireshark̗j
Wiresharkɂ͒j܂BWireshark̓JUXVeBɂ~Y[wŃRs[^TCGXw񂾃WFhER[YiGerald CombsĵłB1988NGPLiGNU Public LicensejɂJ܂i̖OEtherealjB
EtherealJꂽ8NAR[Y͐VȃLA߂Ă܂ŋ΂߂ĂƂސE܂BcOȂސEƂEthereal̒쌠Ă߁AR[YEtherealȏJ邱ƂłȂȂĂ܂܂BɁAR[YEthereal̊J`[́A2006N΂WiresharkƂVȏW擾܂B
Wireshark͔ɐlCAIɐĂ܂BJɂ500l̐lĂ܂BEtherealƂ̃vO͂JĂ܂B

Wireshark̗_
Wiresharkɂ́AXpPbg͂slɂƂĕ֗Ȃ܂܂ȓ܂B1͂ŏqׂXjbt@̕]ڂɏ]Wireshark]Ă݂܂傤B

T|[gĂvgR
WiresharkIPDHCP̂悤ȈʓIȂ̂AAppleTalkBitTorrent̂悤ȓ̃[J[\tgEFAłgȂ̂܂ŁA850ȏ̃vgRT|[gĂ܂BWireshark̓I[v\[XfƂĊJĂAWireshark̃Abvf[gƂɐVvgRǉĂ܂B

@߂ɂȂƂłAWiresharkT|[gĂȂvgR΁Ał̃vgRT|[gR[hWireshark̊J҂ɒ񋟂邱Ƃł܂i񂻂̃R[hF΂łjB

[U[thǂ
Wiresharkɂ͑̃Xjbt@ɔהɕ₷C^[tF[XĂ܂Bj[͂킩₷A₷CAEgGUIx[X̃AvP[VłBƂ΃f[^̓vgRƂɐFĂȂǁA[UreB݌vɂȂĂ܂Btcpdump̂悤ȓȃR}hCC^[tF[X̃AvP[VƈႢAWireshark̓pPbg͂n߂悤ƂlɂƂĎg₷c[Ƃ܂B

RXg
Wireshark̓I[v\[XŁAGPLCZX̂Ɩœ肷邱Ƃł܂BlpłppłANłWireshark_E[hĎgƂł܂B

@Wireshark͂ɖłAԈĂ𕥂Ăl܂BeBayŃXjbt@ƁAWiresharḱuvtFbViƃCZXvAŒቿił39.95hŔ悤ƂĂlX񂢂邱Ƃɋł傤B񂱂͒ԂłA{ɔȂAɓdbBP^bL[IŔɏoĂr[`̕ɂĘb܂傤B

Xjbt@̃T|[g̐
\tgEFȂP͂̃T|[gɂČ܂ƂĂߌł͂܂BWireshark̂悤ȃt[ŌJĂ\tgEFAɂ́AT|[gƂ݂̂܂BI[v\[X̃\tgEFÃT|[ǵA[U[ɗĂ镔܂BK^ȂƂɁAWireshark̃[U[R~jeB̓I[v\[XvWFNg̒łɊłBWiresharkWeby[Wɂ́AIChLgAJ҂̂߂WikiAFAQAJ҂QĂ郁[OXgɓo^邽߂̕@ڂĂ܂BCACE TechnologiesSharkNetvO𗘗p΁ALT|[g󂯂邱Ƃł܂B

OS̃T|[g
WiresharkWindowsAMac OS XALinuxȂǁA̎vOŜقƂǂT|[gĂ܂BWiresharkWeby[WŁAT|[gĂOS̈ꗗ邱Ƃł܂B

Wireshark̃CXg[
Wireshark̃CXg[͋قǊȒPłBCXg[OɁAȉ̃VXev𖞂Ă邩ǂmFKv܂B

CPU 400MHzȏ
128MBRAM
75MBȏ̋󂫗e
v~XLX[hT|[gĂNIC
WinPcappPbghCoiWindowŝ݁j

WinPcappPbghCóAPcappPbghCoWidows APIłB̃hCoɂĐ̃pPbgf[^Lv`AtB^OANICv~XLX[hɐ؂ւł悤ɂȂ܂B
WinPcap͌ʂŃ_E[h邱Ƃł܂ihttp://www.winpcap.orgjAWiresharkɂWinPcapĂ̂ł̕Kv͂܂BĂWinPcap͓삪mFꂽo[Wł̂ŁAʂɃCXg[AWireshark̃pbP[WCXg[邱Ƃ߂܂B


Windowsł̃CXg[
܂AWiresharkWeby[Wihttp://www.wireshark.org/jAŐVłWireshark_E[hĂBWebTCg̃_E[hZNVւƐi݁A~[TCgIĂBpbP[W_E[hAȉ̎菇ŃCXg[ĂB

1D.exet@C_uNbNA\ꂽ_CAO[Next]{^NbN܂B
2Dgpǂ݁AӂȂ[I Agree]{^NbN܂B
3DCXg[R|[lg}3-1̂悤ɑI܂Bł͉ύX[Next]NbN܂B

}3-1@CXg[R|[lgI

4D[Additional Tasks]EBhE[Next]NbN܂B
5DWireshark̃CXg[͂A[Next]{^NbN܂B
6DWinPcapCXg[邩ǂ̃_CAO\̂ŁA[Install WinPcap]`FbN{bNX}3-2̂悤ɃIɂȂĂ邱ƂmFA[Install]{^NbN܂BCXg[n܂܂B

}3-2@WinPcappPbghCoCXg[

7DWireshark̃CXg[̓rŁAWinPcappPbghCõCXg[n܂܂B_CAO\̂[Next]{^NbNAgpǂł[I Agree]{^NbNĂB
8DWinPcappPbghCoCXg[܂BI[Finish]{^NbN܂B
9DWireshark̃CXg[܂BI[Next]{^NbN܂B
10DCXg[̏ImFEBhEŁA[Finish]{^NbN܂B


Linuxł̃CXg[
܂ACXg[pbP[W肵܂BAׂĂLinuxfBXgr[VpbP[W񋟂Ă킯ł͂܂B

ʂɃVXeChx[X̃\tgEFȀꍇA[gANZXKvƂȂ܂B\[XRpC[J\tgEFACXg[́Aʏ탋[gANZXȂŃCXg[\łB

RPMx[X̃VXe
Red Hat Linux̂悤RPMx[X̃fBXgr[VWiresharkCXg[ꍇ́AK؂ȃCXg[VpbP[WWiresharkWebTCg_E[hĂBR\[JÂ悤ɓ͂܂it@C̓_E[hpbP[Ŵ̂ɕςĂj

rpm  ivh wireshark-0.99.3.i386.rpm

ˑpbP[WCXg[ĂȂꍇ́ACXg[ēxWiresharkCXg[ĂB

DEBx[X̃VXe
DebianUbuntû悤DEBx[X̃fBXgr[V̏ꍇ́AVXe|WgWiresharkCXg[邱Ƃł܂BR\[JÂ悤ɓ͂ĂB
apt-get install wireshark

\[XRpC
莝LinuxfBXgr[VpbP[WǗ\tgEFAgĂȂꍇAWiresharkCXg[œKȕ@̓\[X̃RpCłB̂߂ɂ͎̂悤Ɏs܂B

1DWiresharkWeby[W\[XpbP[W_E[h܂B
2D̂悤ɓ͂ăA[JCu𓀂܂it@C̓_E[hpbP[Ŵ̂ɕςĂjB
tar  jxvf wireshark-1.2.2.tar.bz2
3Dt@C̉𓀐ƂȂVKɍ쐬fBNgɕς܂B
4D[gx̃[U[̏ꍇA\[Xݒ肵AR}h./configuregLinuxfBXgr[V𐳂\zł悤ɂ܂BftHg̃CXg[VIvVȊÔ̂gꍇ́A̎_ł̃IvVw肵܂BˑpbP[WȂꍇAG[̉\Ȃ܂BCXg[΁A}3-3̂悤ȃbZ[W\͂łB

}3-3@./configureR}hŐꍇ̃AEgvbg

5D[make]R}h͂A\[XoCiɂ܂B
6D[make install]ōŏICXg[N܂B

Mac OS XVXeł̃CXg[
Mac OS X Snow LeopardWiresharkCXg[ɂ͎኱̒ӂKvłACXg[͓̂̂eł͂܂BCXg[̎菇܂B

1DWiresharkWeby[WDMGpbP[W_E[h܂B
2DWireshark.appAvP[VtH_ɃRs[܂B
3DWirehsark.app̃[eBeBtH_J܂B
4Dt@C_[Go]NbNA[Go To Folder]I܂B/user/local/bin/Ɠ͂AfBNgJ܂B
5DR}hCtH_̒g/user/local/bin/ɃRs[܂Bɂ̓pX[h̓͂KvłB
6D[eBeBtH_ŁAChmodBPFtH_StartupItemstH_ɃRs[܂BsCXg[ɂ́AēxpX[h̓͂߂܂B


Wireshark̊{
Wireshark悭CXg[ł΁AɂgƂł܂BɂȂ̓Xjbt@ɂ̂łBc\܂I
Wireshark͋Nł͓ɋ͕̂\܂Bʔ̂ɂ͉f[^KvłB

ŏ̃pPbgLv`
WiresharkŃpPbg͂ɂ́A܂pPbgLv`Ȃ΂܂Bulbg[NɏQȂ̂ɂǂăpPbgLv`̂낤HvƋ^Ɏv܂B
܂lbg[Nɂ́AɏQ݂Ă܂B^Ȃlbg[N[U[SɃ[𑗐MāAׂĂɓ͂ǂmFĂȂB
2ɃpPbg͂́AQƂ̂ł͂܂Bۂ̂ƂAlbg[NǗ҂̓guV[eBOQ̂Ȃlbg[N̉͂ɎԂĂ܂Blbg[ÑguV[eBOʓIɍs߂ɂ́Albg[NȏԂɂƂ̏񂪕KvȂ̂łBƂDHCP̏Q悤ƂꍇADHCP̃gtBbNǂ̂Ȃ̂𗝉ĂKv܂B
܂lbg[Nُ̈邽߂ɂ́AȏԂmĂȂ΂ȂȂƂƂłBlbg[NɓĂƂɂ΁AȂƂ̃gtBbN̏Ԃ킩܂B
ł͂pPbgLv`Ă݂܂傤I

1DWiresharkN܂B
2DCj[[Capture]IA[Interfaces]NbN܂BpPbgLv`łNIC̈ꗗAIPAhXƂƂɃ_CAOɕ\܂B
3D}3-4̂悤ɁAgNICIA[Start]NbNA܂̓EFJy[W̃C^[tF[XXgꗗ̉ɂNICNbN܂BEBhEf[^Ŗ܂͂łB

}3-4@pPbgLv`NICIB

4D҂ď\ɃpPbgLv`łALv`̃hbv_Ej[[Stop]{^NbN܂B

ȏ̎菇ŃpPbgLv`IƁAWireshark̃CEBhEɃf[^\܂Bʂ̃f[^Ɉ|邩܂񂪁ACEBhE̋@\𗝉΁AقǓƂ͂܂B


Wireshark̃CEBhE
pPbg͒ɈԂ悭̂ÃCEBhEł傤Bɂ̓Lv`ꂽׂẴpPbgA₷`ɃtH[}bgĕ\Ă܂BLv`pPbggāA}3-5Ɏ悤Wireshark̃CEBhEĂ݂܂傤B

}3-5@ 3̃yC̃CEBhE

CEBhE3̃yC̕\݂͂ɈˑĂ܂BpPbgꗗ̃yCiijpPbgNbNƁApPbgڍׂ̃yCiijɂ̃pPbg̏ڍׂ\܂B܂AoCĩyCiijł̃pPbg̃oCif[^邱Ƃł܂B

@}3-5ŁApPbgꗗ̃yCɏvgR\Ă̂킩܂BCĂAvgŘڂɈႢ͂܂Blbg[NŎ󂯎ꂽׂẴpPbg\܂B

eyCɊ܂܂͎̂̒ʂłB

pPbgꗗ̃yC
ĩyCɂ́ALv`t@Cɑ݂pPbg̈ꗗApPbgԍALv`ꂽԁApPbg̑MƈApPbg̃vgRȂpPbgɊ܂܂ƂƂɕ\Ă܂B

@{ł̃gtBbNƂṔApPbgꗗ̃yCɕ\Ă邷ׂẴpPbĝƂƎvĂBƂDNS̃gtBbNƌƂɂ́ApPbgꗗ̃yCɕ\Ă邷ׂĂDNS̃pPbĝƂłB

pPbgڍׂ̃yC
ĩyCɂ́ApPbg̏ڍׂc[ɕ\Ă܂Bc[͍ŏ܂肽܂Ă܂AWJ邱ƂłׂĂ̏邱Ƃł܂B

oCĩyC
ĩyCɂ́AtH[}bgO̐̃pPbg\Ă܂B܂AP[uʂpPbg̖{̌`łB̂܂܂ł͉͂ɍƂƂƎv܂B

Wiresharkݒ
Wireshark͂܂܂ȃJX^}CY\łBWireshark̐ݒʂ́AC̃hbv_Ej[[Edit][Preferences]NbNƕ\܂Bݒ_CAOɂ͐}3-6̂悤ɁA̃JX^}CY\ȃIvV܂܂Ă܂B

}3-6@ݒʂ̃IvVWiresharkJX^}CY

Wiresharkݒʂ́A6̎ȃZNVɕĂ܂B

[User Interface]ZNV
Wiresharkł̃f[^̕\@ݒł܂Bł́AEBhȄꏊL邩ǂAyC̃CAEgAXN[o[̈ʒuApPbgꗗ̃yC̈ʒuAf[^\Ƃ̃tHgAEBhẼJ[Ȃǂݒł܂B

[Capture]ZNV
ftHgNICAv~XLX[hftHgŎgp邩ApPbgꗗ̃yCɃA^CɃLv`pPbg\邩ȂǁALv`̕@ɂĐݒł܂B

[Printing]ZNV
f[^vgAEgۂ̃IvVݒł܂B

[Name Resolution]@ZNV
MACAhXAlbg[NA|[gԍ̖O邩ǂݒł܂B܂AÕNGXg̍ő吔ݒł܂B

[Statistics]ZNV
Wireshark̓v@\̂̃IvVݒł܂B

[Protocols]ZNV
WiresharkŃfR[h\Ȃ܂܂ȃpPbg̃Lv`\Ɋ֘AIvVݒł܂BׂẴvgRݒł킯ł͂܂񂪁A܂܂ȃIvVύX\ȃvgR܂BȂÃIvV͓ɗRȂΕύXȂق悢ł傤B


pPbg̐F
WiresharkŃpPbgLv`ƁA}3-7̗̂悤ɁApPbgꗗ̃yCŃpPbg܂܂ȐFɐF邱ƂɋCÂł傤i}̓mNłAӖ͂킩܂ˁjB̐F̓_Ɍ߂Ă悤Ɍ܂Ał͂܂B

}3-7@vgRƂɐFA₷ȂĂ

epPbg̓vgRƂɐFĂ܂BƂ΁ADNS̃gtBbN͐AHTTP̃gtBbN͗΂ƂłBFĂ邨ŁApPbgꗗ̃yCɕ\Ă邷ׂẴpPbg11mFKv܂BȃLv`t@CƂɁA̐F̋@\̂ŉ͂啝ɃXs[hAbv̂邱Ƃł傤B
}3-8̂悤ɁAF̃[́A[Coloring Rules]_CAOŐݒ肪\łB̃_CAOJɂ́AC̃hbv_Ej[[View]IA[Coloring Rules]NbN܂B

}3-8@[Coloring Rules]_CAOŁApPbg̐F[ݒ肷

F̃[̈ꗗ\̂ŁAD݂̐FɕύX܂BƂ΁AHTTP̃gtBbN̔wiFftHg̗΂烉x_[ɕς菇́Aȉ̂ƂłB

1DWiresharkNA[Coloring Rules]EBhE\܂i[View][Coloring Rules]IjB
2DꗗHTTP̐F[NbN܂B
3D[Edit]{^NbN܂B}3-9̂悤[Edit Color Filter]_CAO\܂B

}3-9@[Colring Rules]_CAOł́AFƔwiFݒł

4D[Background Color]{^NbN܂B
5DFIA[OK]{^NbN܂B
6D[OK]{^2񉟂ăCEBhEɖ߂܂BYpPbgAݒ肵FɕύXĂ܂B

WiresharkgăpPbg͂ĂƁAvgR̃vgR葽\Ă邱ƂɋCÂł傤BFĂ邱Ƃłꂪ蕪₷Ȃ̂łBƂDHCPT[oɏQNIPAhX̊蓖Ă܂ȂȂꍇADHCP̃gtBbNFɐFĂ΁ACEBhEFɐ܂܂BāADHCP̃gtBbN̑IʂeՂɂȂA悭pPbg͂ł悤ɂȂ܂B
̃JX^tB^[ʂɁAF[𗘗p邱Ƃ\łB
WiresharkNAsƂŁApPbg͂s܂B͂ł̓Lv`pPbgǂɂĐ܂B

