代码之家  ›  专栏  ›  技术社区  ›  SamGoody

Wireshark中URL的解码

  •  3
  • SamGoody  · 技术社区  · 16 年前

    他们的说明手册给出了“主页”的URL,主页上安装了一个可爱的activeX控件,用于处理与实际视频服务器的所有交互。

    我尝试了Wireshark,它捕获了所有的数据包,但没有显示不同页面的完整URL。[即:如果物理设备位于212.234.56.456,则无论我连接到主页(212.234.56.456/home.html)、视频服务器(可能类似于212.234.56.456/video.amp)还是设备内的任何其他内容,它都会显示相同的URL。]

    尽管对他们的网站和手册进行了大量的搜刮和搜索,但我无法理解如何获取服务器的整个URL。

    有人能告诉我一个教程或一页的说明吗?或者只是详细说明如何做到这一点?

    谢谢

    协议是TCP

    视频端口:8000[服务器中有一个更改端口的选项。默认值为8000]

    我正在尝试使用类似VLC或RealPlayer的东西连接到视频流[用于重新流媒体],而不是它附带的activeX控件。 服务器正在编码为MPEG 4[h.264],并且应该是流式RTSP://

    我加载页面,启动Wireshark,然后按下ActiveXControl上的播放按钮(启动视频)。下面是Wireshark捕获的第一个数据包[在许多数据包中,这是对视频的请求]:

    No.     Time        Source                Destination           Protocol Info
     53 7.198090    192.168.1.4           212.143.234.227       TCP      4734 > irdmi [SYN] Seq=0 Win=65535 Len=0 MSS=1460
    
    Frame 53 (62 bytes on wire, 62 bytes captured)
        Arrival Time: Jul  8, 2009 13:24:35.008644000
        [Time delta from previous captured frame: 0.048542000 seconds]
        [Time delta from previous displayed frame: 7.198090000 seconds]
        [Time since reference or first frame: 7.198090000 seconds]
        Frame Number: 53
        Frame Length: 62 bytes
        Capture Length: 62 bytes
        [Frame is marked: False]
        [Protocols in frame: eth:ip:tcp]
        [Coloring Rule Name: TCP SYN/FIN]
        [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
    Ethernet II, Src: Intel_66:1e:41 (00:19:d1:66:1e:41), Dst: GigasetC_49:05:10 (00:21:04:49:05:10)
        Destination: GigasetC_49:05:10 (00:21:04:49:05:10)
            Address: GigasetC_49:05:10 (00:21:04:49:05:10)
            .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
            .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        Source: Intel_66:1e:41 (00:19:d1:66:1e:41)
            Address: Intel_66:1e:41 (00:19:d1:66:1e:41)
            .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
            .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        Type: IP (0x0800)
    Internet Protocol, Src: 192.168.1.4 (192.168.1.4), Dst: 212.143.234.227 (212.143.234.227)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 48
        Identification: 0x816c (33132)
        Flags: 0x04 (Don't Fragment)
            0... = Reserved bit: Not set
            .1.. = Don't fragment: Set
            ..0. = More fragments: Not set
        Fragment offset: 0
        Time to live: 128
        Protocol: TCP (0x06)
        Header checksum: 0xf83b [correct]
            [Good: True]
            [Bad : False]
        Source: 192.168.1.4 (192.168.1.4)
        Destination: 212.143.234.227 (212.143.234.227)
    Transmission Control Protocol, Src Port: 4734 (4734), Dst Port: irdmi (8000), Seq: 0, Len: 0
        Source port: 4734 (4734)
        Destination port: irdmi (8000)
        [Stream index: 3]
        Sequence number: 0    (relative sequence number)
        Header length: 28 bytes
        Flags: 0x02 (SYN)
            0... .... = Congestion Window Reduced (CWR): Not set
            .0.. .... = ECN-Echo: Not set
            ..0. .... = Urgent: Not set
            ...0 .... = Acknowledgement: Not set
            .... 0... = Push: Not set
            .... .0.. = Reset: Not set
            .... ..1. = Syn: Set
                [Expert Info (Chat/Sequence): Connection establish request (SYN): server port irdmi]
                    [Message: Connection establish request (SYN): server port irdmi]
                    [Severity level: Chat]
                    [Group: Sequence]
            .... ...0 = Fin: Not set
        Window size: 65535
        Checksum: 0x378c [validation disabled]
            [Good Checksum: False]
            [Bad Checksum: False]
        Options: (8 bytes)
            Maximum segment size: 1460 bytes
            NOP
            NOP
            SACK permitted
    
    3 回复  |  直到 10 年前
        1
  •  5
  •   TroyJ    14 年前

    真正的答案是在WireShark中,您需要进入分析菜单,选择“解码为”。然后在下一个对话框中选择“传输”。选择您正在使用的TCP端口,然后选择您希望Wireshark对其进行解码的方式(右侧)。如果您选择http,它将显示您的URL,如果您实际上正在使用http。

    您还可以复制数据并将其粘贴到像这样的十六进制解码器中 http://home2.paulschou.net/tools/xlate/

        2
  •  1
  •   dpavlin    16 年前

    据我所见,这是来自初始TCP/IP握手的SYN数据包,它还不包含URL。您必须捕获更多的数据包(如果使用gui,则在wireshark中向下移动)。

    如果您打算比较转储,以可复制模式捕获较长的代码段(打开设备电源,单击少量操作,关闭电源)是一个很好的建议。

        3
  •  0
  •   EricLaw    16 年前

    Fiddler不捕获非HTTP(S)流量。您有任何理由相信所讨论的ActiveX使用的是HTTP而不是直接的TCP/IP吗?