wireshark vs sinffer

**Turing** · 08-05-04, 02:01

大家觉得那个比较好用，今天我在家里查ARP病毒了，用了wireshark，抓包信息如下:
protocol info

ARP DNS address tell IP address1

ARP DNS address tell IP address 2

ARP DNS address tell IP address 1

ARP DNS address tell IP address 3

ARP DNS address tell IP address 6

个人感觉，从info角度来看，局域网没有ARP病毒，如果抓包如下情况:

15:01:53.597121 arp who-has 192.168.0.1 tell 192.168.0.2
15:01:53.597125 arp who-has 192.168.0.1 tell 192.168.0.2
15:01:53.617436 arp who-has 192.168.0.2 tell 192.168.0.2
15:01:53.617440 arp who-has 192.168.0.2 tell 192.168.0.2
15:01:53.637942 arp who-has 192.168.0.3 tell 192.168.0.2
15:01:53.637946 arp who-has 192.168.0.3 tell 192.168.0.2
15:01:53.658452 arp who-has 192.168.0.4 tell 192.168.0.2
15:01:53.658456 arp who-has 192.168.0.4 tell 192.168.0.2
15:01:53.678963 arp who-has 192.168.0.5 tell 192.168.0.2
15:01:53.678967 arp who-has 192.168.0.5 tell 192.168.0.2
15:01:53.699464 arp who-has 192.168.0.6 tell 192.168.0.2

说明用了ARP病毒，而且192.168.0.2成了伪网关了！
以上个人之见，望大家各自表态！