WireShark v3.2.0 Stable Win/Mac 多語言中文版- 網絡數據包分析軟件

2019-12-19 Comments 0 Comment

Wireshark（前稱Ethereal）是一個網絡封包分析軟件。網絡封包分析軟件的功能是擷取網絡封包，並儘可能顯示出最為詳細的網絡封包資料。WireShark 是一款非常棒的Unix 和Windows 上的開源網絡協議分析器。它可以實時檢測網絡通訊數據，也可以檢測其抓取的網絡通訊數據快照文件。可以通過圖形界面瀏覽這些數據，可以查看網絡通訊數據包中每一層的詳細內容。

WireShark v3.2.0 Stable Win/Mac 多語言中文版- 網絡數據包分析軟件

WireShark 擁有許多強大的特性：包含有強顯示過濾器語言（Rich Display Filter Language）和查看TCP 會話重構流的能力；它更支持上百種協議和媒體類型；擁有一個類似tcpdump (一個Linux 下的網絡協議分析工具)的名為Tethereal 的的命令行版本。

網絡封包分析軟件的功能可想像成“電工技師使用電錶來量測電流、電壓、電阻” 的工作– 只是將場景移植到網絡上，並將電線替換成網絡線。在過去，網絡封包分析軟件是非常昂貴，或是專門屬於營利用的軟件。Ethereal的出現改變了這一切。在GNUGPL通用許可證的保障範圍底下，使用者可以以免費的代價取得軟件與其源代碼，並擁有針對其源代碼修改及客制化的權利。Ethereal是目前全世界最廣泛的網絡封包分析軟件之一。

網絡管理員使用Wireshark來檢測網絡問題，網絡安全工程師使用Wireshark來檢查資訊安全相關問題，開發者使用Wireshark來為新的通訊協定除錯，普通使用者使用Wireshark來學習網絡協定的相關知識當然，有的人也會“居心叵測”的用它來尋找一些敏感信息……

Wireshark不是入侵偵測軟件（Intrusion DetectionSoftware,IDS）。對於網絡上的異常流量行為，Wireshark不會產生警示或是任何提示。然而，仔細分析Wireshark擷取的封包能夠幫助使用者對於網絡行為有更清楚的了解。Wireshark不會對網絡封包產生內容的修改，它只會反映出目前流通的封包資訊。Wireshark本身也不會送出封包至網絡上。

Wireshark 3.0.0 已於2月28日發布正式版，並提供了Windows 和macOS 平台的安裝程序，源代碼也已開源。關於Wireshark 的介紹這裡就不多說了，作為世界上最受歡迎的網絡數據包分析軟件，主要是用於排查和分析網絡問題，或者調試通信協議，再則就是新手用於學習網絡協議相關知識。

按照官方的說法，3.0 版本對用戶界面進行了許多改進。此前的舊版用戶界面(GTK+)已被刪除，並不再提供支持。而且從該版本起，Wireshark 要求使用 Qt 5.2 或更高版本，不再支持Qt 4；要求使用 GLib 2.32, GnuTLS 3.2, Python 3.4 或更高版本，不再支持 Python 2.7。

還有一個重要的變化就是WinPcap —— 用於捕獲和傳輸網絡數據包的工具，目前在Windows 版本上已被Npcap 取代。因為WinPcap 自2013年以來就一直沒有更新，已停止維護，而Npcap 大約在半年前還收到更新，並且仍然由Nmap 項目組在積極維護。

除了更好的安全性和提供了WinPcap中沒有的一些高級功能之外（支持回環抓包和802.11 WiFi monitor模式的抓包），Npcap的另一個優點是其驅動程序已經過微軟的測試和簽名，允許用戶在具有更嚴格簽名要求的Windows 10上運行它。

此外，最新版本的Wireshark 還增加了對數十種新協議的支持。

Wireshark 3.2.0 Release Notes

What is Wireshark?

Wireshark is the world’s most popular network protocol analyzer. It is used for troubleshooting, analysis, development and education.

What’s New

This is the last release branch with official support for Windows 7 and Windows Server 2008 R2.

Many improvements have been made. See the “New and Updated Features” section below for more details.

New and Updated Features

The following features are new (or have been significantly updated) since version 3.2.0rc2:

Minor bug fixes.

The following features are new (or have been significantly updated) since version 3.2.0rc1:

Minor bug fixes.

The following features are new (or have been significantly updated) since version 3.1.1:

Miscellaneous UI fixes and updates.
The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5.

The following features are new (or have been significantly updated) since version 3.1.0:

Automatic updates are supported on macOS.
You can now select multiple packets in the packet list at the same time
- They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …”
- They can be marked/unmarked or ignored/unignored at the same time
- They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print”
You can now follow HTTP/2 and QUIC streams.
You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so.
The Windows packages are now built using Microsoft Visual Studio 2019.
IOGraph automatically adds a graph for the selected display filter if no previous graph exists
Action buttons for the display filter bar may be aligned left via the context menu
- The “Expression…” toolbar entry has been moved to “Analyze › Display filter Expression …” as well as to the context menu of the display filter toolbar
Allow extcaps to be loaded from the personal configuration directory
The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4.

The following features are new (or have been significantly updated) since version 3.0.0:

You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “ Apply Filter”
You can drag and drop a column entry to the display filter to create a filter for it.
You can import profiles from a .zip archive or an existing directory.
Dark mode support on macOS and dark theme support on other platforms has been improved.
Brotli decompression support in HTTP/HTTP2 (requires the brotli library).
The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback.
WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571).
A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark.
Editcap can now split files on floating point intervals.
Windows .msi packages are now signed using SHA-2. .exe installers are still dual-signed using SHA-1 and SHA-2.
The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value.
Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown.
The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters.
Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC).
HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to “streaming_content_type” dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called.
The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature.
The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1.

New Protocol Support

3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR ), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message – CAMv1, ITS message – DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech),Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/ IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN)