📄 النص الكامل للصفحة
تحليل فحص واير شارك Analyzing a Wireshark Scan
يمكن استخدام واير شارك لتحليل تدفق بيانات الشبكة من عمليات فحص تم إجراؤها سابقًا ثم حفظها، حيث ستستخدم ملف فحص محفوظ للعثور على نشاط مشبوه على الشبكة. ويمكنك تنزيل هذا الملف من الرابط التالي:
https://bl-xtrtransfer.s3.amazonaws.com/KSA/G12/CYB/U2/L2/Scan_results.pcapng
--- SECTION: لفتح ملف واير شارك: ---
لفتح ملف واير شارك:
من علامة تبويب File (ملف)، اضغط على خيار Open (فتح). 1
من نافذة Open Capture File (فتح ملف الالتقاط)، اختر ملف Scan_results.pcapng (فحص النتائج). 2
اضغط على Open (فتح). 3
سيقوم ملف الفحص بإخراج كافة البيانات المسجلة للشبكة. 4
شكل 2.13: فتح ملف وايرشارك
وزارة التعليم
Ministry of Education
2025 - 1447
74
--- VISUAL CONTEXT ---
**IMAGE**: QR Code
Description: A QR code is displayed, which likely links to the provided URL for downloading the Wireshark capture file.
Context: Provides a convenient way to access the necessary file for the exercise.
**FIGURE**: Wireshark Network Analyzer
Description: A screenshot of the Wireshark application interface. The main menu bar is visible with 'File', 'View', 'Go', 'Capture', 'Analyze', 'Statistics', 'Telephony', 'Wireless', 'Tools', and 'Help' options. The 'File' dropdown menu is open, showing options like 'Open', 'Open Recent', 'Merge...', 'Import from Hex Dump...', 'Close', 'Save', 'Save As...', 'File Set', 'Export Specified Packets...', 'Export Packet Dissections', 'Export Packet Bytes...', 'Export PDUs to File...', 'Export TLS Session Keys...', 'Export Objects', 'Print...', and 'Quit'. The 'Open' option is highlighted. A circled number '1' is overlaid on the 'Open' option.
Key Values: File, View, Go, Capture, Analyze, Statistics, Telephony, Wireless, Tools, Help, Open, Open Recent, Merge..., Import from Hex Dump..., Close, Save, Save As..., File Set, Export Specified Packets..., Export Packet Dissections, Export Packet Bytes..., Export PDUs to File..., Export TLS Session Keys..., Export Objects, Print..., Quit
Context: This figure visually demonstrates the first step in the instructions: navigating to the 'File' menu and selecting 'Open' to load a network capture file.
**FIGURE**: Wireshark - Open Capture File
Description: A screenshot of the 'Open Capture File' dialog box. The dialog shows a file browser interface. 'Look in: Documents' is displayed. A file named 'Scan_results' is selected in the main file list. Below the file list, 'File name: Scan_results' is populated, and 'Files of type: All Files' is selected. Other details include 'Read filter:', 'Automatically detect file type', 'Format: Wireshark - .pcapng', 'Size: 9046 KB, 14387 data records', and 'Start/elapsed: 2020-03-03 14:22:21 / 00:00:33'. Buttons for 'Open', 'Cancel', and 'Help' are visible. A circled number '2' is overlaid near the 'Scan_results' file selection, and a circled number '3' is overlaid on the 'Open' button.
Key Values: Look in: Documents, Scan_results, File name: Scan_results, Files of type: All Files, Read filter:, Automatically detect file type, Format: Wireshark - .pcapng, Size: 9046 KB, 14387 data records, Start/elapsed: 2020-03-03 14:22:21 / 00:00:33, Open, Cancel, Help
Context: This figure illustrates the second and third steps of the instructions: selecting the 'Scan_results.pcapng' file and then clicking the 'Open' button to load it into Wireshark.
**FIGURE**: Scan_results.pcapng
Description: A screenshot of the main Wireshark window after a capture file has been opened. The window title shows 'Scan_results.pcapng'. The menu bar (File, Edit, View, Go, Capture, Analyze, Statistics, Telephony, Wireless, Tools, Help) and a toolbar are visible. A filter bar with 'Apply a display filter <Ctrl-/>' is present. The main pane displays a table of captured packets. Below the packet list, a packet details pane and a hex dump pane are visible. A circled number '4' is overlaid on the packet list area.
Table Structure:
Headers: No. | Time | Source | Destination | Protocol | Length | Info
Rows:
Row 1: 1 | 0.000000 | 199.0.0.46 | 199.0.0.154 | TLSv1.2 | 97 | Application Data
Row 2: 2 | 0.000074 | 199.0.0.154 | 199.0.0.46 | TCP | 54 | 3389 → 51549 [ACK] Seq=1 Ack=44 Win=63846 Len=0
Row 3: 3 | 0.005153 | 199.0.0.46 | 199.0.0.154 | TLSv1.2 | 196 | Application Data
Row 4: 4 | 0.016036 | 199.0.0.154 | 199.0.0.46 | TCP | 54 | 3389 → 51549 [ACK] Seq=1 Ack=144 Win=63846 Len=0
Row 5: 5 | 0.032026 | 199.0.0.46 | 199.0.0.154 | TLSv1.2 | 104 | Application Data
Row 6: 6 | 0.032106 | 199.0.0.154 | 199.0.0.46 | TCP | 54 | 3389 → 51549 [ACK] Seq=1 Ack=144 Win=63746 Len=0
Row 7: 7 | 0.048186 | 199.0.0.46 | 199.0.0.154 | TLSv1.2 | 104 | Application Data
Row 8: 8 | 0.064014 | 199.0.0.154 | 199.0.0.46 | TCP | 54 | 3389 → 51549 [ACK] Seq=1 Ack=244 Win=63646 Len=0
Row 9: 9 | 0.064088 | 199.0.0.46 | 199.0.0.154 | TLSv1.2 | 104 | Application Data
Row 10: 10 | 0.080097 | 199.0.0.154 | 199.0.0.46 | TCP | 54 | 3389 → 51549 [ACK] Seq=1 Ack=244 Win=63546 Len=0
Data: The table displays network packet information including packet number, time, source IP, destination IP, protocol, length, and additional info. The packet details pane shows parsed information for a selected packet, and the hex dump pane shows the raw hexadecimal and ASCII representation of the packet data.
Key Values: File, Edit, View, Go, Capture, Analyze, Statistics, Telephony, Wireless, Tools, Help, Apply a display filter <Ctrl-/>, Frame 1: 97 bytes on wire (776 bits), 97 bytes captured (776 bits) on interface \Device\NPF_{28219D41-4ED8-41EC-9A38-A27D90E3A2FA}, ID 0, Ethernet II, Src: Dell_89:6a:2f (8c:ec:4b:89:6a:2f), Dst: Dell_9c:e5:c3 (f8:b1:56:9c:e5:c3), Internet Protocol Version 4, Src: 199.0.0.154, Dst: 199.0.0.46, Transmission Control Protocol, Src Port: 51549, Dst Port: 3389, Seq: 1, Ack: 1, Len: 43, Transport Layer Security, 0000 f8 b1 56 9c e5 c3 8c ec 4b 89 6a 2f 08 00 45 00, 0010 00 53 17 fc 40 00 80 06 53 e0 c7 00 00 2e c7 00, 0020 00 9a c9 5d 0d 3d bf fa 49 c7 34 81 03 74 50 18, 0030 20 14 20 65 00 00 17 03 03 00 26 00 00 00 00, 0040 00 37 22 34 5f 8b 48 6f d9 54 fd 43 6c e2 53 a6, 0050 5e a8 45 00 ce 97 ff 3c 4d 8e 21 d6 d8 6b 98 34, 0060 7b
Context: This figure shows the final outcome of opening the capture file, presenting the raw network data for detailed analysis, which is the core function of Wireshark.