Habka promiscuous ee adapterka VPN wuxuu dilaa xiriirka
Qabashada adapterka tunnel waxay joojin kartaa gudbintiisa. Dami habka promiscuous, dooro lakabka ka jawaaba su’aasha, oo u qabo faylka sir ahaan.
Wireshark wuxuu si fiican uga shaqeeyaa interface Ethernet, ka dibna adapterka VPN, tunnelku wuu joojiyaa maraakiibta isagoo maraya isla markii qabashadu bilaabato. Daaqadda qabashadu way sii buuxsantaa, sidaas darteed qalabku wuxuu u muuqdaa mid caafimaad qaba halka xiriirka hoostiisa uu dhintaa. Habka promiscuous waa sababta caadiga ah, maxaa yeelay darawalka tunnelka ee la weyddiisto frame kasta oo ku yaal qayb uusan lahayn wuxuu ku dhici karaa xaalad aan waxba ka bixin.
Marka hore dami ikhtiyaarkaas, ka dibna go’aanso lakabka aad runtii u baahan tahay inaad aragto.
Laba adapter, laba aragtiyo kala duwan
Macaamiilka VPN wuxuu caadi ahaan soo bandhigaa laba interface: kan jirka ah ee qaada gaadiidka sirka ah, iyo mid macmal ah oo qaada taraafikada gudaha ee la furey. Waxay ka jawaabaan su’aalo kala duwan. Qabashada jirka waxay muujinaysaa meelaha ugu dambeeya, dekedaha iyo cabbirka baakadaha, halka kan macmalku muujiyo borotokoolka codsiga sida tunnelku u gaarsiiyo. Doorashada mid iyada oo aan la garanayn su’aasha aad weyddiinayso waxay lumisaa qabashada.
Ma jiro aragti ka mid ah oo ka sarraysa tan kale, oo hal qabasho marar dhif ah ay ka jawaabto labada su’aalood isku mar.
Dooro interface-ka su’aasha halkii aad ka dooran lahayd nidaamka liiska, maxaa yeelay macaamiil qaab PPP ah wuxuu u soo bandhigi karaa adapterkiisa qalab Ethernet ah oo magaca la muujiyay kuma sheegayo lakabka aad dooratay. Qabashada gateway ama deked muraayad ah waxay ku dartaa aragti saddexaad, oo muujinaysa wadada gudbinta ka dib, oo halkaas ayaa marinka asymmetric iyo shaandhaynta ka muuqdaan.
| Capture point | What it shows | What it cannot show |
|---|---|---|
| Physical interface | Outer endpoints, ports, packet sizes | Any inner payload |
| Tunnel interface | Decrypted inner traffic | What the VPN added around it |
| Gateway or mirror | Forwarded path after the tunnel | The client's own decision process |
Sababta habka promiscuous u jebiyo adapterka tunnelka
Habka promiscuous wuxuu weyddiinayaa darawalka inuu keeno frames aan loo jeedin host-ka, taas oo macne leh qayb Ethernet la wadaago iyo macne aad u yar tunnel dhibic-ilaa-dhibic ah. Qaar ka mid ah darawallada si deggan ayay u maareeyaan codsiga; qaar kale waxay joojiyaan ka soo saarista taraafikada dirista safka, oo interface-ku si aamusan ayuu u noqdaa god madow. Qabashadu weli way diiwaangalisaa waxa soo gaadha, sidaas darteed faylku wuxuu u muuqdaa caddaynta xiriir shaqaynaya. Farqiga u dhexeeya waxa faylku muujinayo iyo waxa interface-ku sameeyay ayaa ah dhammaan dabinada.
Dami ikhtiyaarka ka hor baakadda koowaad, hay filtrka qabashada mid cidhiidhi ah oo isticmaal buffer yar. Buffer giraan weyn oo ku yaal interface mashquul ah wuxuu tuurayaa frames-kii muhiimka ahaa, taas oo keenta qabasho dhammaystiran meel kasta marka laga reebo halka cilladdu ku jirtay.
Haddii xiriirku istaago badhtamaha qabashada, jooji oo fiiri soo kabashada. Hal observation taas ayaa kala saarta saameynta dhinaca ee qabashada iyo cillad dhab ah oo tunnelka, oo waxay qaadanaysaa waqti ka yar wax kasta oo hagaajin filter ah.
Ka dhigista qabashada IPsec mid la akhriyi karo
Qabashada IPsec kaligeed lama akhriyi karo, maxaa yeelay ESP waxay sireeysaa culeyska. Wireshark wuu furi karaa marka aad bixiso furayaasha fadhiga, ama marka uu raaci karo gorgortanka IKE ee abuuray, taas oo macneheedu yahay in gacan-qabashadu ay tahay inay ku jirto isla faylka.
Furayaashu way dhacaan. Ka dib marka dhinacyadu cusboonaysiiyaan furayaasha, koox furayaal duug ah ayaa joojiya shaqeynta badhtamaha qabashada, natiijaduna waxay u muuqataa cilad decoder ah halkii ay ahaan lahayd xad waqti.
Raac qaabka furayaasha la diiwaangeliyay ee alaab-qeybiyaha halkii aad ka soo dejin lahayd shay ka yimid il aan xiriir la lahayn, oo filo in qaar ka mid ah barnaamijyadu ay gebi ahaanba diidaan socodka shaqada. Marka gateway-ku aanu bixin furayaasha ama aanu oggolaan qabashada, aqbal in culeyska aan laga baari karin halka aad joogto. Diiwaannada dhibcaha ugu dambeeya iyo tiriyayaasha interface-ka ayaa ah caddaynta hadhay, oo sida caadiga ah way ku filan yihiin su’aal marinka.
Qabasho aad si ammaan ah ula wadaagi karto
Qabashada gudaha waxay uga dhowdahay daadinta aqoonsiga marka loo eego log. Waxay ka koobnaan kartaa magacyo, cinwaanno iyo qoraal cad oo ka yimid borotokool loo qoray iyada oo loo maleynayo in aan cidna waligood akhrin doonin, taas oo faylka laftiisa ka dhigaysa shay xasaasi ah halkii ay ahaan lahayd falanqayn.
Hubi in host-ka iyo shabakaddu yihiin kuwa aad loo oggol yahay inaad wax ka qabato, qor interface-ka iyo filter-ka labadaba natiijada la socota, ku xaddid fadhiga dhawr daqiiqo oo ka jawaaba su’aasha, oo tirtir faylka markaad dhamaysato. Haddii ay tahay in la wadaago, marka hore sharax socodka ama ka saar culeyska.
Ka dib ku celi hawsha isticmaalaha asalka ah. Qabasho caddaynaysa in baakad soo gaadhay ma aha caddayn in codsigu aqbalay jawaabta, oo farqiga u dhexeeya labadaas ayaa sida caadiga ah ah halka cilladda dhabta ah ay ku nooshahay.