现在困扰的是不懂抓到的为什么是以太网数据帧结构
success: device: eth1
EN10MB
Ethernet
id: 1
Packet length: 54
Number of bytes: 54
Recieved time: Fri Jan 4 09:35:03 2013
e0 05 c5 60 3a d4 c4 17 fe 75 d9 7c 08 00 45 00
00 28 1e 4e 40 00 40 06 8f 74 c0 a8 01 70 4a 7d
80 78 c9 b5 00 50 ea bb 8e 29 c6 1d bf c2 50 11
02 45 8d 28 00 00
id: 2
Packet length: 54
Number of bytes: 54
Recieved time: Fri Jan 4 09:35:03 2013
c4 17 fe 75 d9 7c e0 05 c5 60 3a d4 08 00 45 00
00 28 ad a3 00 00 2d 06 53 1f 4a 7d 80 78 c0 a8
01 70 00 50 c9 b5 c6 1d bf c2 ea bb 8e 2a 50 11
03 ea 56 0f 00 00
id: 3
Packet length: 54
Number of bytes: 54
Recieved time: Fri Jan 4 09:35:03 2013
e0 05 c5 60 3a d4 c4 17 fe 75 d9 7c 08 00 45 00
00 28 1e 4f 40 00 40 06 8f 73 c0 a8 01 70 4a 7d
80 78 c9 b5 00 50 ea bb 8e 2a c6 1d bf c3 50 10
02 45 8d 28 00 00
id: 4
Packet length: 54
Number of bytes: 54
Recieved time: Fri Jan 4 09:35:04 2013
e0 05 c5 60 3a d4 c4 17 fe 75 d9 7c 08 00 45 00
00 28 e6 f7 40 00 40 06 e8 64 c0 a8 01 70 72 70
36 eb 90 fd 00 50 5a 5f 74 b0 e4 ad e9 ba 50 11
01 f0 6b 8e 00 00
id: 5
Packet length: 54
Number of bytes: 54
Recieved time: Fri Jan 4 09:35:04 2013
e0 05 c5 60 3a d4 c4 17 fe 75 d9 7c 08 00 45 00
00 28 19 1f 40 00 40 06 b6 3d c0 a8 01 70 72 70
36 eb 90 f8 00 50 a3 55 99 27 78 41 6c 0a 50 11
02 16 6b 8e 00 00
id: 6
Packet length: 66
Number of bytes: 66
Recieved time: Fri Jan 4 09:35:04 2013
e0 05 c5 60 3a d4 c4 17 fe 75 d9 7c 08 00 45 00
00 34 f0 32 40 00 40 06 df 1d c0 a8 01 70 72 70
36 eb 91 03 00 50 e5 77 68 d1 5b 7c 64 9b 80 11
04 9d 6b 9a 00 00 01 01 08 0a 00 00 07 fb 22 6e
28 20
管理会计成本会计财务管理内容交叉问题的探讨
id: 7
Packet length: 66
Number of bytes: 66
Recieved time: Fri Jan 4 09:35:04 2013
e0 05 c5 60 3a d4 c4 17 fe 75 d9 7c 08 00 45 00
00 34 98 5e 40 00 40 06 36 f2 c0 a8 01 70 72 70
36 eb 91 06 00 50 97 7a 11 4c 4b 22 dc 84 80 11
02 7e 6b 9a 00 00 01 01 08 0a 00 00 07 fb 22 6e
27 62
目测eth1是以太网接口 试试 capture options的 link-layer header type的选项，有没有其它类型 混杂模式的勾去掉，无线网卡一般不支持混杂模式，支持的很贵。 Wireshark捕捉到的数据包当然是帧，链路层的。可以使用 sudo ifconfig eth0 down 把第一个网卡禁用，就可以使用wlan捕捉数据包了