Wireshark抓包理解APR协议
查看自己电脑上的ARP表包含ip(Internet地址)和MAC(物理地址)
arp -a
下载Wireshare选择你电脑对应版本即可
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612094737002-595925633.png)
如果win10显示找不到接口,用管理员去运行:以管理员的身份在cmd中输入命令 net start npf
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612094840729-1842882183.png)
选择你正在使用的网络,点击上面蓝色鱼鳍的按钮,开始捕获
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095127734-1331577926.png)
有这么多的报文怎么找到想找的那个报文呢
如果要看ARP协议,直接输入之后回车 我的局域网地址是192.168.50.27
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095301734-92513838.png)
双击进入
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095322839-2064105726.png)
具体结构为
物理层
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095548821-937780143.png)
数据链路层
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095636356-1145810523.png)
如果目标MAC为FF:FF:FF:FF:FF...代表这是一条广播消息
源地址是我这台电脑的MAC地址
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095720050-422895896.png)
对方给我回的消息
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612095923100-740515900.png)
![](https://img2020.cnblogs.com/blog/1391439/202006/1391439-20200612100007332-1473226966.png)