WIRESHARKKULLANICIREHBER

Hazrlayan:HaktanAKPINARem@il:r3db4r0n@hotmail.com

mailto:e-m@il

NDEKLER

Wireshark Hakknda......................................................................................................... 3 zellikler..............................................................................................................................3Kurulum...............................................................................................................................6 Kaynak kodundan Kurulum....................................................................................6 Paket Yneticileriyle Kurulum................................................................................7 Windows altnda Kurulum.......................................................................................7Kullanc arayz................................................................................................................9Menler...............................................................................................................................10 File ............................................................................................................................10 Edit ...........................................................................................................................12 View..........................................................................................................................14 Go..............................................................................................................................15 Capture.....................................................................................................................16 Anaylze.....................................................................................................................19 Statistic................................................................ .....................................................22Filtreler.. ............................................................................................................................26 Capture Filter..........................................................................................................26 Display Filter...........................................................................................................28Karlatrma Deerleri....................................................................................................30Grntleme Filtresi Mantksal Operatrleri................................................................31rnek fadeler...................................................................................................................33

Paketlerle Oynamak..........................................................................................................34

rnek Sorunlarda Wireshark Kullanimi........................................................................35Torrent Sorunu..................................................................................................................35Wireshark ile Veri Madencilii........................................................................................36Arp Poisoning Tespiti........................................................................................................37Blaster Wormu Tespiti......................................................................................................38Port Tarama Tespiti..........................................................................................................39Syn Flooding Tespiti..........................................................................................................39Balanti Sorunu Tespiti....................................................................................................40Casus Yazlm Tespiti........................................................................................................41Os Fingerprinting Tespiti (Icmp Tabanl).......................................................................42Neden SSH..........................................................................................................................42Messenger zerine.............................................................................................................44TCP Oturumuna Mdahale zerine ..............................................................................44FTP Saldr Tespiti.............................................................................................................47Son Szler ..........................................................................................................................49Kaynaklar..............................................................................................49

HAKKINDA

WiresharkGNUGeneralPublicLicence(GPL)altndayaymlananokglzellikleresahipbirakkaynaklpaketanalizyazlmdr.Wiresharkanzakarherhangibirsaldrdurumundasiziuyaracaksaldrtespitsistemideildir.Farklbirdurumolutuundasorununneolduunufarketmenizeyardmcolur.

ZELLKLER

*Windowsve*nixsistemlerdealabilir.*Aarabirimindenezamanlpaketyakalayabilir.*Paketleriokayrntlbirekildeprotokolbilgileriylegrntler*Yakaladpaketlerikaydetmeimkanvardr*Kriterleregrepaketfiltrelememevcuttur*Kriterleregrepaketaramamevcuttur*paketgrnmlerirenklendirilerekkullanmkolaylatrlabilir.*eitliistatistikleryapabilir*...vedahabirou

Wiresharkfarklatrlerindeyakalamayapabilir.Desteklenenmedyatrlerihttp://wiki.wireshark.org/CaptureSetup/NetworkMediaadresindegsterilmektedir.

Wiresharkdierpaketyakalamayazlmlarnnfarklformatlardakidosyalarnaabilir.

libpcap,tcpdumpvetcpdumpformatndakidieraralar.SunsnoopveatmsnoopShomiti/FinisarNovellLANalyzerMicrosoftNetworkMonitorAIX'siptraceCincoNetworksNetXrayNetworkAssociatesWindowstabanlSnifferveSnifferProNetworkGeneral/NetworkAssociatesDOStabanlSniffer(sktrlmyadasktrlmam)AGGroup/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabbeRADCOM'sWAN/LANAnalyzerNetworkInstrumentsObserverversion9Lucent/AscendrouterdebugktsHPUXnettlToshibaISDNroutersdumpktsISDN4BSDi4btracearacEyeSDNUSBS0CiscoSecureIntrusionDetectionSystem'denIPLogformatpppdlogs(pppdumpformat)VMS'sTCPIPtrace/TCPtrace/UCX$TRACEaralarkts

http://wiki.wireshark.org/CaptureSetup/NetworkMedia

DBSEtherwatchVMSutilityktsVisualNetworks'VisualUpTimetrafficCoSineL2debugktsAccellent's5ViewsLANagentsktsEndaceMeasurementSystems'ERFformatLinuxBluezBluetoothstackhcidumpwtracesCatapultDCT2000.outdosyas

Wiresharkdierpaketyakalamayazlmlarnnaabileceiformattaktlarretir.

libpcap,tcpdumpvetcpdumpformatndakidieraralar (*.pcap,*.cap,*.dmp)5Views(*.5vw)HPUXnettl(*.TRC0,*.TRC1)MicrosoftNetworkMonitorNetMon(*.cap)NetworkAssociatesSnifferDOS(*.cap,*.enc,*.trc,*fdc,*.syc)NetworkAssociatesSnifferWindows(*.cap)NetworkInstrumentsObserverversion9(*.bfr)NovellLANalyzer(*.tr1)Sunsnoop(*.snoop,*.cap)VisualNetworksVisualUpTimetraffic(*.*)

MicrosoftWindows

Windows2000,XPHome,XPPro,XPTabletPC,XPMediaCenter,Server2003yadaVista32bitPentium(tavsiyeolunan:400MHzvest),64bitWoW64128MBRAM(tavsiyeolunan:256MBytesvest)75MBbodiskalan800*600(1280*1024vesttavsiyeolunur)znrlk65536(16bit)

Desteklenennetworkkartlar

Ethernet:Windowsuntandherhangibirkartolabilir. WLAN:MicroLogixdesteklistesinebaknz, Diertrleriin:http://wiki.wireshark.org/CaptureSetup/NetworkMedia

adresinebaknz

64bitilemcilerdeWireshark32bitemulasyonuolarakalr.BununiinWinPcap4.0gereklidir

Trafiiyounolanalardayksekilemcigc,fazlacaramvediskalannasahipolunmastavsiyeolunur.

Wiresharknkmesidurumundaayrntlariin

http://wiki.wireshark.org/CaptureSetup/NetworkMedia

http://wiki.wireshark.org/KnownBugs/OutOfMemoryadresinebaknz.Unix/Linux

Wiresharkbirokunixplatformundaalmaktadr.

AppleMacOSXDebianGNU/LinuxFreeBSDGentooLinuxHPUXMandrivaLinuxNetBSDOpenPKGRedHatFedora/EnterpriseLinuxrPathLinuxSunSolaris/i386SunSolaris/Sparc

Sizinplatformunuzauygunpaketmevcutdeilsekaynakkoduindiripkurabilirsiniz.

ProgramnsonversiyonunuWiresharkwebsitesindenindirebilirsiniz:

http://www.wireshark.org/download.html

Problembildirmeveyardmalmakiin:

Eerwiresharklailgiliprobleminizvarsaveyardmistiyorsanz..

*Birokkullanlbilgiyiwiresharkwebsayfasndabulabilirsiniz http://www.wireshark.org*Wiresharkwikisayfashttp://wiki.wireshark.orgwiresharkvepaket yakalamakonularndagenibiryelpazedebilgisunmaktadr.*FAQ:http://www.wireshark.org/faq.html*Postalisteleri

wiresharkannounce:Wiresharkiinyenisrmduyurularyaparwiresharkusers:Kurulumvekullanmsorunlarvezmleriniierir.wiresharkdev:Gelitiricileriindir

Unix/linuxplatformlarndahatabildirmekiinprogramnbacktracektsnbirdosyayayazpwiresharkdev[AT]wireshark.orgadresinepostalayn.

http://www.wireshark.org/faq.htmlhttp://wiki.wireshark.org/http://www.wireshark.org/http://www.wireshark.org/download.html http://wiki.wireshark.org/KnownBugs/OutOfMemory

KURULUM

Kurulumiingerekendosyalarhttp://www.wireshark.orgadresindeneldeedebilirsiniz.

Kaynakkodundankurulumiin:

GTK+veGLibninkuruluolduundaneminolun(eeryoksahttp://www.gtk.orgadresindenteminedebilirsiniz)

KaynaktanGTK+kurulumuiin:

#gzipdcgtk+1.2.10.tar.gz|tarxvf#cdgtk+1.2.10#./configure#make#makeinstall

*nixplatformlarndalibpcapktphanelerininkuruluolduundaneminolun.Sonversiyonunuhttp://www.tcpdump.orgadresindenindirebilirsiniz.

Kaynaktanlibpcapkurulumuiin:

#gzipdclibpcap0.9.4.tar.Z|tarxvf#cdlibpcap0.9.4#./configure#make#makeinstall

Wiresharkklasriinde./configurekomutunuverin.makekomutunuverin.Sonolarakmakeinstallkoutunuverin.

Configurebasamandasorunolursasebebiiinkaynakdiziniindeconfigure.logdosyasnabaknz.MuhtemelensisteminizdeGTK+yoktury