Wireshark常見(jiàn)數(shù)據(jù)包的常用指標(biāo)分析

1、Wireshark常見(jiàn)數(shù)據(jù)包的常用指標(biāo)分析By 張廣龍2本次講解主要是利用wireshark工具對(duì)以下數(shù)據(jù)包的常用指 標(biāo)分析講解DNS（成功率和時(shí)延）DHCP（成功率）TCP（時(shí)延、丟包、亂序和重傳）HTTP（網(wǎng)頁(yè)成功率和時(shí)延）3數(shù)據(jù)包的協(xié)議交互過(guò)程:DNS Client DNS ServerDNS Server DNS ClientDNS請(qǐng)求的成功率計(jì)算：成功率計(jì)算：dns響應(yīng)數(shù)/dns連接數(shù)操作講解：1、 frame.time過(guò)濾出指定時(shí)間段的DNS報(bào)文 frame.time=2014-12-07 19:00:00 and frame.time=2014-12-07 19:00:00 an

2、d frame.time=2014-12-07 19:00:00 and frame.time=2014-12-07 19:00:00 and frame.time=2014-12-07 19:00:00 and frame.time=2014-12-07 19:00:00 and frame.time=2014-12-07 19:20:00 and TCP2、使用wireshark的“Analyze”-“Expert Info”統(tǒng)計(jì)warmings信息3、利用上述TCP重傳率計(jì)算公式算出TCP的重傳率TCP協(xié)議HTTP協(xié)議HTTP網(wǎng)頁(yè)成功率計(jì)算： HTTP網(wǎng)頁(yè)成功率 sum（http.res

3、ponse.code =2014-12-07 19:00:00 and frame.time=2014-12-07 19:20:00 and http.response2、分別使用wireshark記錄以下響應(yīng)的數(shù)據(jù)包http.response.code = 500http.response.code 400http.response.code = 404http.response.code = 4033、利用上述公式計(jì)算出網(wǎng)頁(yè)成功率HTTP協(xié)議HTTP時(shí)延驗(yàn)證計(jì)算：操作同TCP時(shí)延分析，即在原來(lái)的基礎(chǔ)上過(guò)濾所有HTTP的TCP報(bào)文即可Tcp previous segment lost tcp

4、先前的分片丟失Tcp retransmission tcp重傳丟失的部分Tcp acked lost segment tcp應(yīng)答丟失Tcp dup ack Tcp dup ack XXXX#X 則代表了數(shù)據(jù)段丟失TCP狀態(tài)，XXXX代表數(shù)據(jù)丟失的位置，#后代表第幾次丟失Tcp segment of a reassembled PDU主機(jī)響應(yīng)一個(gè)查詢或者命令時(shí)如果要回應(yīng)很多數(shù)據(jù)（信息）而這些數(shù)據(jù)超出了TCP的最大MSS時(shí)，主機(jī)會(huì)通過(guò)發(fā)送多個(gè)數(shù)據(jù)包來(lái)傳送這些數(shù)據(jù)（注意：這些包并未被分片）。對(duì)wireshark來(lái)說(shuō)這些對(duì)相應(yīng)同一個(gè)查詢命令的數(shù)據(jù)包被標(biāo)記了TCP segment of a reassembled PDU（wireshark如何識(shí)別多個(gè)數(shù)據(jù)包是對(duì)同一個(gè)查詢數(shù)據(jù)包的響應(yīng)? wireshark是根據(jù)sequence number來(lái)識(shí)別，這些數(shù)據(jù)包Ack number是相同的，當(dāng)然number的數(shù)值與查詢數(shù)據(jù)包中的next sequence number也是一樣的Tcp out-of-order 應(yīng)該有很多原因。但是多半是