RawCap.exe --help
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
D:\rawcap>RawCap.exe --help
NETRESEC RawCap version 0.1.5.0
http:
//www
.netresec.com
Usage: RawCap.exe [OPTIONS] <interface_nr> <target_pcap_file>
OPTIONS:
-f Flush data to
file
after each packet (no buffer)
-c <count> Stop sniffing after receiving <count> packets
-s <sec> Stop sniffing after <sec> seconds
INTERFACES:
0. IP : 192.168.1.103
NIC Name : 無線網絡連接
NIC Type : Wireless80211
1. IP : 169.254.134.220
NIC Name : 本地連接 2
NIC Type : Ethernet
2. IP : 169.254.94.64
NIC Name : Bluetooth 網絡連接
NIC Type : Ethernet
3. IP : 127.0.0.1
NIC Name : Loopback Pseudo-Interface 1
NIC Type : Loopback
Example: RawCap.exe 0 dumpfile.pcap
|
使用RawCap監聽本地回環接口
TCP, UDP and ICMP packets can, however, all be sniffed properly from localhost on newer operating systems like Windows Vista and Windows 7.
方式一：
|
1
2
3
4
5
|
D:\rawcap>RawCap.exe 3 localhost_capture.pcap
Unable to enter promiscuous mode (RCVALL_ON), using RCVALL_SOCKETLEVELONLY.
Sniffing IP : 127.0.0.1
File : localhost_capture.pcap
Packets : 0
|
方式二：
|
1
2
3
4
5
|
D:\rawcap>RawCap.exe 127.0.0.1 localhost_capture.pcap
Unable to enter promiscuous mode (RCVALL_ON), using RCVALL_SOCKETLEVELONLY.
Sniffing IP : 127.0.0.1
File : localhost_capture.pcap
Packets : 0
|
方式三：
|
1
2
3
4
5
6
7
8
9
10
11
12
|
D:\rawcap>RawCap.exe
Interfaces:
0. 192.168.1.103 無線網絡連接 Wireless80211
1. 169.254.134.220 本地連接 2 Ethernet
2. 169.254.94.64 Bluetooth 網絡連接 Ethernet
3. 127.0.0.1 Loopback Pseudo-Interface 1 Loopback
Select interface to sniff [default
'0'
]: 3
Output path or filename [default
'dumpfile.pcap'
]: localhost_capture.pcap
Unable to enter promiscuous mode (RCVALL_ON), using RCVALL_SOCKETLEVELONLY.
Sniffing IP : 127.0.0.1
File : localhost_capture.pcap
Packets : 0
|
Unable to enter promiscuous mode
通過上面的結果，可以看到這個提示Unable to enter promiscuous mode (RCVALL_ON), using RCVALL_SOCKETLEVELONLY.
根據我的測試也不能監聽localhost。就是因為Unable to enter promiscuous mode (RCVALL_ON), using RCVALL_SOCKETLEVELONLY.這個原因。
看網上說cmd不是以管理員身份運行的，但我以管理員身份運行后還是不能有這個提示，並不能監聽到localhost。
暫時無解。。。。。。。。