[安恒公司原创，转载请注明] Ethereal：A Network Packet Sniffing Tool
Ethereal是免费而且功能强大的网络调试和数据包协议分析软件。Ethereal 基本类似于tcpdump，但 Ethereal 还具有设计完美的 GUI 和众多分类信息及过滤选项。用户通过 Ethereal，同时将网卡设置成混合模式，可以查看到网络中发送的所有通信流量。目前，Ethereal在分析无线局域网时主要要注意的是“捕捉”网卡上传输数据时的设置。
Ethereal 应用于故障修复、分析、软件和协议开发以及教育领域。它具有用户对协议分析软件所期望的所有标准特征，并具有其它同类产品所不具备的有关特征。Ethereal 是*种开发源代码的许可软件，允许用户向其中添加改进方案。Ethereal 适用于当前所有较为流行的计算机系统，包括 Unix、Linux 和 Windows 。
在使用Ethereal捕捉数据包时系统可能会有两种方法来存储捕捉的数据：
- “真实”的802.11数据帧：捕捉硬件和驱动提供给了真实的无线局域网传输协议数据，它们是完整的802.11帧头，要注意这中间有大量的“无线电信息”，比如信号强度等等。
- “虚假”的以太帧：捕捉硬件和强度将802.11帧头转换成以太网帧头，由此整个数据包看起来象正常的以太网数据帧。但是，此时所有的802.11专有的管理和控制帧由于它们没有在标准以太网中的对应内容而被丢弃了。
所以在使用Ethereal捕捉无线局域网的数据包时，选择正确的无线网卡工作模式就是非常关键的了。下图是安恒公司无线网分析工程师在linux系统上使用Ethereal捕捉和分析安恒公司实验用无线局域网时的抓图，点击可以放大。
下表是Ethereal支持的无线局域网协议域的内容：
IEEE 802.11 wireless LAN
Protocol field name: wlan
Versions: 0.9.0 to 0.10.12
| Field name | Type | Description | Versions |
|---|---|---|---|
| wlan.addr | 6-byte Hardware (MAC) Address | Source or Destination address | 0.9.0 to 0.10.12 |
| wlan.aid | Unsigned 16-bit integer | Association ID | 0.9.0 to 0.10.12 |
| wlan.bssid | 6-byte Hardware (MAC) Address | BSS Id | 0.9.0 to 0.10.12 |
| wlan.ccmp.extiv | String | CCMP Ext. Initialization Vector | 0.10.5 to 0.10.12 |
| wlan.channel | Unsigned 8-bit integer | Channel | 0.9.4 to 0.10.12 |
| wlan.da | 6-byte Hardware (MAC) Address | Destination address | 0.9.0 to 0.10.12 |
| wlan.data_rate | Unsigned 8-bit integer | Data Rate | 0.9.4 to 0.10.12 |
| wlan.duration | Unsigned 16-bit integer | Duration | 0.9.0 to 0.10.12 |
| wlan.fc | Unsigned 16-bit integer | Frame Control Field | 0.9.0 to 0.10.12 |
| wlan.fc.ds | Unsigned 8-bit integer | DS status | 0.9.0 to 0.10.12 |
| wlan.fc.frag | Boolean | More Fragments | 0.9.0 to 0.10.12 |
| wlan.fc.fromds | Boolean | From DS | 0.9.0 to 0.10.12 |
| wlan.fc.moredata | Boolean | More Data | 0.9.0 to 0.10.12 |
| wlan.fc.order | Boolean | Order flag | 0.9.0 to 0.10.12 |
| wlan.fc.pwrmgt | Boolean | PWR MGT | 0.9.0 to 0.10.12 |
| wlan.fc.retry | Boolean | Retry | 0.9.0 to 0.10.12 |
| wlan.fc.subtype | Unsigned 8-bit integer | Subtype | 0.9.0 to 0.10.12 |
| wlan.fc.tods | Boolean | To DS | 0.9.0 to 0.10.12 |
| wlan.fc.type | Unsigned 8-bit integer | Type | 0.9.0 to 0.10.12 |
| wlan.fc.type_subtype | Unsigned 16-bit integer | Type/Subtype | 0.9.0 to 0.10.12 |
| wlan.fc.version | Unsigned 8-bit integer | Version | 0.9.0 to 0.10.12 |
| wlan.fc.wep | Boolean | WEP flag | 0.9.0 to 0.10.12 |
| wlan.fcs | Unsigned 32-bit integer | Frame check sequence | 0.9.0 to 0.10.12 |
| wlan.flags | Unsigned 8-bit integer | Protocol Flags | 0.9.0 to 0.10.12 |
| wlan.frag | Unsigned 16-bit integer | Fragment number | 0.9.0 to 0.10.12 |
| wlan.fragment | Frame number | 802.11 Fragment | 0.9.4 to 0.10.12 |
| wlan.fragment.error | Frame number | Defragmentation error | 0.9.4 to 0.10.12 |
| wlan.fragment.multipletails | Boolean | Multiple tail fragments found | 0.9.4 to 0.10.12 |
| wlan.fragment.overlap | Boolean | Fragment overlap | 0.9.4 to 0.10.12 |
| wlan.fragment.overlap.conflict | Boolean | Conflicting data in fragment overlap | 0.9.4 to 0.10.12 |
| wlan.fragment.toolongfragment | Boolean | Fragment too long | 0.9.4 to 0.10.12 |
| wlan.fragments | None | 802.11 Fragments | 0.9.4 to 0.10.12 |
| wlan.qos.ack | Unsigned 16-bit integer | Ack Policy | 0.10.5 to 0.10.12 |
| wlan.qos.priority | Unsigned 16-bit integer | Priority | 0.10.5 to 0.10.12 |
| wlan.ra | 6-byte Hardware (MAC) Address | Receiver address | 0.9.0 to 0.10.12 |
| wlan.reassembled_in | Frame number | Reassembled 802.11 in frame | 0.9.12 to 0.10.12 |
| wlan.sa | 6-byte Hardware (MAC) Address | Source address | 0.9.0 to 0.10.12 |
| wlan.seq | Unsigned 16-bit integer | Sequence number | 0.9.0 to 0.10.12 |
| wlan.signal_strength | Unsigned 8-bit integer | Signal Strength | 0.9.4 to 0.10.12 |
| wlan.ta | 6-byte Hardware (MAC) Address | Transmitter address | 0.9.0 to 0.10.12 |
| wlan.tkip.extiv | String | TKIP Ext. Initialization Vector | 0.10.5 to 0.10.12 |
| wlan.wep.crc | Unsigned 32-bit integer | WEP CRC (not verified) | 0.9.0 to 0.9.5 |
| wlan.wep.icv | Unsigned 32-bit integer | WEP ICV | 0.9.5 to 0.10.12 |
| wlan.wep.iv | Unsigned 24-bit integer | Initialization Vector | 0.9.0 to 0.10.12 |
| wlan.wep.key | Unsigned 8-bit integer | Key | 0.9.0 to 0.10.12 |
| wlan.wep.weakiv | Boolean | Weak IV | 0.10.9 to 0.10.12 |
附：Ethereal支持相当多的协议（号称700余种）
3COMXNS, 3GPP2 A11, 802.11 MGT, 802.11 Radiotap, 802.3 Slow protocols, 9P, AAL1, AAL3/4, AARP, ACAP, ACN, ACSE, ACtrace, ADP, AFP, AFS (RX), AH, AIM, AIM Administration, AIM Advertisements, AIM BOS, AIM Buddylist, AIM Chat, AIM ChatNav, AIM Directory, AIM Email, AIM Generic, AIM ICQ, AIM Invitation, AIM Location, AIM Messaging, AIM OFT, AIM Popup, AIM SSI, AIM SST, AIM Signon, AIM Stats, AIM Translate, AIM User Lookup, AJP13, ALC, ALCAP, AMR, ANS, ANSI BSMAP, ANSI DTAP, ANSI IS-637-A Teleservice, ANSI IS-637-A Transport, ANSI IS-683-A (OTA (Mobile)), ANSI IS-801 (Location Services (PLD)), ANSI MAP, AODV, AOE, ARCNET, ARP/RARP, ARTNET, ASAP, ASF, ASN1, ASP, ATM, ATM LANE, ATP, ATSVC, AVS WLANCAP, AX4000, AgentX, Armagetronad, Auto-RP, BACapp, BACnet, BEEP, BER, BFD Control, BGP, BICC, BOFL, BOOTP/DHCP, BOOTPARAMS, BOSSVR, BROWSER, BSSAP, BSSGP, BUDB, BUTC, BVLC, BitTorrent, Boardwalk, CAMEL, CAST, CBAPDev, CCSDS, CDP, CDS_CLERK, CFLOW, CGMP, CHDLC, CIP, CLDAP, CLEARCASE, CLNP, CLTP, CMIP, CMP, CMS, CONV, COPS, COSEVENTCOMM, COSNAMING, COTP, CPFI, CPHA, CRMF, CSM_ENCAPS, CUPS, CoSine, DAAP, DCCP, DCERPC, DCE_DFS, DCOM, DDP, DDTP, DEC_DNA, DEC_STP, DFS, DHCPFO, DHCPv6, DIS, DISTCC, DLSw, DLT User A, DLT User B, DLT User C, DLT User D, DNP 3.0, DNS, DNSSERVER, DOCSIS, DOCSIS BPKM-ATTR, DOCSIS BPKM-REQ, DOCSIS BPKM-RSP, DOCSIS DSA-ACK, DOCSIS DSA-REQ, DOCSIS DSA-RSP, DOCSIS DSC-ACK, DOCSIS DSC-REQ, DOCSIS DSC-RSP, DOCSIS DSD-REQ, DOCSIS DSD-RSP, DOCSIS INT-RNG-REQ, DOCSIS MAC MGMT, DOCSIS MAP, DOCSIS REG-ACK, DOCSIS REG-REQ, DOCSIS REG-RSP, DOCSIS RNG-REQ, DOCSIS RNG-RSP, DOCSIS TLVs, DOCSIS UCC-REQ, DOCSIS UCC-RSP, DOCSIS UCD, DOCSIS VSIF, DOCSIS type29ucd, DRSUAPI, DSI, DSSETUP, DTP, DTSPROVIDER, DTSSTIME_REQ, DUA, DVMRP, Data, Diameter, E.164, EAP, EAPOL, ECHO, EDONKEY, EFS, EIGRP, ENC, ENIP, ENRP, ENTTEC, EPM, EPMv4, ESIS, ESP, ESS, ETHERIC, ETHERIP, EVENTLOG, Ethernet, FC, FC ELS, FC FZS, FC-FCS, FC-SB3, FC-SP, FC-SWILS, FC-dNS, FCIP, FCP, FC_CT, FDDI, FIX, FLDB, FR, FRSAPI, FRSRPC, FTAM, FTP, FTP-DATA, FTSERVER, FW-1, Frame, G.723, GIF image, GIOP, GMRP, GNUTELLA, GPRS NS, GPRS-LLC, GRE, GSM BSSMAP, GSM DTAP, GSM RP, GSM SMS, GSM SMS UD, GSM_MAP, GSS-API, GTP, GVRP, Gryphon, H.261, H.263, H1, H225, H235, H248, HCLNFSD, HPEXT, HPSW, HSRP, HTTP, HyperSCSI, IAP, IAPP, IAX2, IB, ICAP, ICBAAccoCB, ICBAAccoCB2, ICBAAccoMgt, ICBAAccoMgt2, ICBAAccoServ, ICBAAccoServ2, ICBAAccoServSRT, ICBAAccoSync, ICBABrowse, ICBABrowse2, ICBAGErr, ICBAGErrEvent, ICBALDev, ICBALDev2, ICBAPDev, ICBAPDev2, ICBAPDevPC, ICBAPDevPCEvent, ICBAPersist, ICBAPersist2, ICBARTAuto, ICBARTAuto2, ICBAState, ICBAStateEvent, ICBASysProp, ICBATime, ICEP, ICL_RPC, ICMP, ICMPv6, ICP, ICQ, IDP, IDispatch, IEEE 802.11, IEEE802a, IGAP, IGMP, IGRP, ILMI, IMAP, INAP, INITSHUTDOWN, IOXIDResolver, IP, IP/IEEE1394, IPComp, IPDC, IPFC, IPMI, IPP, IPVS, IPX, IPX MSG, IPX RIP, IPX SAP, IPX WAN, IPv6, IRC, IRemUnknown, IRemUnknown2, ISAKMP, ISDN, ISIS, ISL, ISMP, ISUP, ISystemActivator, IUA, IrCOMM, IrLAP, IrLMP, JFIF (JPEG) image, JXTA, JXTA Framing, JXTA Message, JXTA UDP, JXTA Welcome, Jabber, Juniper, K12xx, KADM5, KINK, KLM, KRB4, KRB5, KRB5RPC, Kpasswd, L2TP, LANMAN, LAPB, LAPBETHER, LAPD, LDAP, LDP, LLAP, LLC, LMI, LMP, LOOP, LPD, LSA, LWAPP, LWAPP-CNTL, LWAPP-L3, LWRES, Laplink, Line-based text data, Log, LogotypeCertExtn, Lucent/Ascend, M2PA, M2TP, M2UA, M3UA, MACC, MAPI, MAP_DialoguePDU, MATE, MDS Header, MEGACO, MGCP, MGMT, MIME multipart, MIPv6, MMS, MMSE, MOUNT, MPEG1, MPLS, MPLS Echo, MQ, MQ PCF, MRDISC, MS Proxy, MSDP, MSMMS, MSNIP, MSNMS, MSRP, MTP2, MTP3, MTP3MG, Manolito, Media, Messenger, Mobile IP, Modbus/TCP, MySQL, NBDS, NBIPX, NBNS, NBP, NBSS, NCP, NDMP, NDPS, NFS, NFSACL, NFSAUTH, NIS+, NIS+ CB, NLM, NLSP, NMAS, NMPI, NNTP, NORM, NSIP, NSPI, NS_CERT_EXTS, NTLMSSP, NTP, NW_SERIAL, NetBIOS, Netsync, Null, OAM AAL, OCSP, OLSR, OPSI, OSPF, PAGP, PARLAY, PCLI, PCNFSD, PER, PFLOG, PFLOG-OLD, PGM, PGSQL, PIM, PKCS-1, PKIX Certificate, PKIX1EXPLICIT, PKIX1IMPLICIT, PKIXPROXY, PKIXQUALIFIED, PKIXTSP, PKInit, PKTC, PN-DCP, PN-RT, PNIO, PNP, POP, PPP, PPP BACP, PPP BAP, PPP CBCP, PPP CCP, PPP CDPCP, PPP CHAP, PPP Comp, PPP IPCP, PPP IPV6CP, PPP LCP, PPP MP, PPP MPLSCP, PPP OSICP, PPP PAP, PPP PPPMux, PPP PPPMuxCP, PPP VJ, PPP-HDLC, PPPoED, PPPoES, PPTP, PRES, PTP, Portmap, Prism, Q.2931, Q.931, Q.933, QLLC, QUAKE, QUAKE2, QUAKE3, QUAKEWORLD, R-STP, RADIUS, RANAP, RDM, RDT, REMACT, REP_PROC, RIP, RIPng, RLM, RMCP, RMI, RMP, RPC, RPC_BROWSER, RPC_NETLOGON, RPL, RQUOTA, RRAS, RSH, RSTAT, RSVP, RSYNC, RS_ACCT, RS_ATTR, RS_BIND, RS_PGO, RS_PLCY, RS_REPADM, RS_REPLIST, RS_UNIX, RTCP, RTMP, RTP, RTP Event, RTPS, RTSP, RTcfg, RTmac, RUDP, RWALL, RX, Raw, Raw_SIP, Raw_SigComp, Redback, Rlogin, SADMIND, SAMR, SAP, SCCP, SCCPMG, SCSI, SCTP, SDLC, SDP, SEBEK, SECIDMAP, SES, SGI MOUNT, SIGCOMP, SIP, SIPFRAG, SIR, SKINNY, SLARP, SLL, SM, SMB, SMB Mailslot, SMB Pipe, SMB_NETLOGON, SMPP, SMRSE, SMTP, SMUX, SNA, SNA XID, SNAETH, SNDCP, SNMP, SONMP, SPNEGO-KRB5, SPOOLSS, SPP, SPRAY, SPX, SRVLOC, SRVSVC, SSCF-NNI, SSCOP, SSH, SSL, STAT, STAT-CB, STP, STUN, SUA, SVCCTL, Serialization, SliMP3, Socks, SoulSeek, Spnego, Symantec, Synergy, Syslog, T.38, TACACS, TACACS+, TALI, TANGO, TAPI, TCAP, TCP, TDMA, TDS, TEI_MANAGEMENT, TELNET, TFTP, TIME, TKN4Int, TNS, TPCP, TPKT, TR MAC, TRKSVR, TSP, TTP, TUXEDO, TZSP, Teredo, Token-Ring, UBIKDISK, UBIKVOTE, UCP, UDP, UDPENCAP, UMA, V.120, V5UA, VLAN, VNC, VRRP, VTP, Vines ARP, Vines Echo, Vines FRP, Vines ICP, Vines IP, Vines IPC, Vines LLC, Vines RTP, Vines SPP, WAP SIR, WBXML, WCCP, WCP, WHDLC, WHO, WINREG, WKSSVC, WLANCERTEXTN, WSP, WTLS, WTP, X.25, X.29, X11, X509AF, X509CE, X509IF, X509SAT, XDMCP, XML, XOT, XYPLEX, YHOO, YMSG, YPBIND, YPPASSWD, YPSERV, YPXFR, ZEBRA, ZIP, cds_solicit, cprpc_server, dce_update, dicom, giFT, h221nonstd, h245, h450, iFCP, iSCSI, iSNS, isup_thin, llb, message/http, nettl, rdaclif, roverride, rpriv, rs_attr_schema, rs_misc, rs_prop_acct, rs_prop_acl, rs_prop_attr, rs_prop_pgo, rs_prop_plcy, rs_pwd_mgmt, rs_repmgr, rsec_login, sFlow,