Wireshark 命令行捕获数据_dumpcap的使用

在 Wireshark 程序目录中，包含两个命令行捕获工具。这两个工具分别是 Dumpcap 和 Tshark。当不能以图形界面方式捕获数据时，可以在命令行使用 dumpcap 或 tshark 程序实施捕获。

一、使用 Dumpcap 捕获数据

执行 dumpcap -h 可以查看参数详情。

1、执行 dumpcap -D 查看本机可用的接口。

D:\Program Files (x86)\Wireshark>dumpcap.exe -D
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">1. </span>\Device\NPF_{ACEA0E58-E009-48BF-A484-A1366798B51D} (鏈湴杩炴帴* 3)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">2. </span>\Device\NPF_{BACE2AAC-EC26-4FC4-B385-DDAFE347F309} (VMware Network Adapter VMnet8)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">3. </span>\Device\NPF_{B038E4F2-4F55-43AD-9583-3D227791EB37} (鏈湴杩炴帴* 2)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">4. </span>\Device\NPF_{3866F6C2-1EFA-4A37-A62B-AE28EF24ABBD} (WLAN)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">5. </span>\Device\NPF_{9738C864-0A1F-490E-98FC-49B52AB40490} (VMware Network Adapter VMnet1)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">6. </span>\Device\NPF_{E4469318-F5DA-467C-AC80-7B4B91264577} (鏈湴杩炴帴)

显示乱码不要介意，可见当前有6个接口。

2、捕获数据。在捕获数据时，可以使用-c 或 -a选项指定停止捕获数据包的条件。本例中选择捕获第4个接口上的数据，并且当捕获文件达到1000KB时自动停止捕获。执行命令如下所示。

<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">D</span>:\Program Files (x86)\Wireshark>dumpcap -i <span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">4</span> -a <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">filesize</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">1000</span> -w <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">e</span>:\file\Wireshark\<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">1000</span>kb.pcapng
Capturing <span class="hljs-literal" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(149, 65, 33); background: transparent;">on</span> <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">'WLAN'</span>
<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">File</span>: <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">e</span>:\file\Wireshark\<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">1000</span>kb.pcapng
Packets <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">captured</span>: <span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">1296</span>
Packets received/dropped <span class="hljs-literal" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(149, 65, 33); background: transparent;">on</span> interface <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">'WLAN'</span>: <span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">1296</span>/<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span> (<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">pcap</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>/<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">dumpcap</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>/<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">flushed</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>/<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">ps_ifdrop</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>) (<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">100.0</span>%)

从输出的信息中可以看到捕获的文件名、数据包数。

3、查看生成捕获文件 100kb.pcapng 的大小。

D:\Program Files (x86)\Wireshark>dir e:\file\Wireshark\1000kb.pcapng
 驱动器 E 中的卷是 文档
 卷的序列号是 000F-D904

 e:\file\Wireshark 的目录

2016/03/01  18:58         1,000,676 1000kb.pcapng
               1 个文件      1,000,676 字节
               0 个目录 13,512,331,264 可用字节

二、使用 Tshark 捕获数据

Tshark 是依赖 dumpcap 捕获数据的。可以通过 tshark -h 查看参数信息。操作如下：

1、打开终端

2、切换到 Wireshark 目录。执行 tshark -D 命令，查看可用的接口。

D:\Program Files (x86)\Wireshark>tshark -D
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">1. </span>\Device\NPF_{ACEA0E58-E009-48BF-A484-A1366798B51D} (鏈湴杩炴帴* 3)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">2. </span>\Device\NPF_{BACE2AAC-EC26-4FC4-B385-DDAFE347F309} (VMware Network Adapter VMnet8)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">3. </span>\Device\NPF_{B038E4F2-4F55-43AD-9583-3D227791EB37} (鏈湴杩炴帴* 2)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">4. </span>\Device\NPF_{3866F6C2-1EFA-4A37-A62B-AE28EF24ABBD} (WLAN)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">5. </span>\Device\NPF_{9738C864-0A1F-490E-98FC-49B52AB40490} (VMware Network Adapter VMnet1)
<span class="hljs-bullet" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">6. </span>\Device\NPF_{E4469318-F5DA-467C-AC80-7B4B91264577} (鏈湴杩炴帴)

3、开始捕获数据。

<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">D</span>:\Program Files (x86)\Wireshark>tshark -i4 -a <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">files</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">3</span> -b <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">duration</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">10</span> -w <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">e</span>:\file\Wireshark\mytshark.pcapng
Capturing <span class="hljs-literal" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(149, 65, 33); background: transparent;">on</span> <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">'WLAN'</span>
<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">1808</span>

以上命令表示指定捕获4号接口，捕获3个文件后自动停止，10秒后捕获下一个文件。

4、查看生成的捕获文件。

D:\Program Files (x86)\Wireshark>dir e:\file\Wireshark\mytshark*
 驱动器 E 中的卷是 文档
 卷的序列号是 000F-D904

 e:\file\Wireshark 的目录

2016/03/01  19:17            22,396 mytshark_00001_20160301191653.pcapng
2016/03/01  19:17           753,168 mytshark_00002_20160301191703.pcapng
2016/03/01  19:17           282,500 mytshark_00003_20160301191713.pcapng
               3 个文件      1,058,064 字节
               0 个目录 13,511,270,400 可用字节

三、使用捕获过滤器

当用户在命令行捕获数据时，可能只想捕获特定的数据。

使用 Dumpcap 指定捕获过滤器进行数据捕获。

<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">D</span>:\Program Files (x86)\Wireshark>dumpcap -i4 -f <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">"tcp port 80"</span> -w <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">e</span>:\file\Wireshark\port80.pcapng
Capturing <span class="hljs-literal" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(149, 65, 33); background: transparent;">on</span> <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">'WLAN'</span>
<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">File</span>: <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">e</span>:\file\Wireshark\port80.pcapng
Packets <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">captured</span>: <span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">287</span>
Packets received/dropped <span class="hljs-literal" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(149, 65, 33); background: transparent;">on</span> interface <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">'WLAN'</span>: <span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">287</span>/<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span> (<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">pcap</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>/<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">dumpcap</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>/<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">flushed</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>/<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">ps_ifdrop</span>:<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">0</span>) (<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">100.0</span>%)

输出的信息显示了捕获的包数和捕获文件名。执行以上命令后，该程序不会自动停止捕获，需要按下 Ctrl + C 组合键停止。使用 Tshark 工具指定捕获过滤器的参数和 Dumpcap 一样，这里不再赘述。

四、使用显示过滤器

在命令行中，使用的显示过滤器比捕获过滤器多。

1、使用捕获过滤器捕获所有 TCP 数据，并保存该捕获文件为 tcp.pcapng。

<span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">D</span>:\Program Files (x86)\Wireshark>tshark -i4 -f<span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">"tcp"</span> -w <span class="hljs-attribute" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 128, 128); background: transparent;">e</span>:\file\Wireshark\tcp.pcapng
Capturing <span class="hljs-literal" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(149, 65, 33); background: transparent;">on</span> <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">'WLAN'</span>
<span class="hljs-number" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(64, 160, 112); background: transparent;">529</span>

2、使用-r参数读取捕获文件的ndash，使用-Y参数指定显示过滤器，并使用-w参数指定保存的新捕获文件。

<span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">D</span><span class="hljs-symbol" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(153, 0, 115); background: transparent;">:</span>\<span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">Program</span> <span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">Files</span> (x86)\<span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">Wireshark</span>>tshark -r <span class="hljs-symbol" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(153, 0, 115); background: transparent;">e:</span>\file\<span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">Wireshark</span>\tcp.pcapng -<span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">Y</span> <span class="hljs-string" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(33, 145, 97); background: transparent;">"tcp.analysis.flags"</span> -w <span class="hljs-symbol" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; color: rgb(153, 0, 115); background: transparent;">e:</span>\file\<span class="hljs-constant" style="border: 0px; margin: 0px; padding: 0px; font-weight: inherit; font-style: inherit; font-family: inherit; vertical-align: baseline; background: transparent;">Wireshark</span>\analysisflags.pcapng

执行以上命令后没有任何输出信息。但是会生成一个新的捕获文件。

3、查看新捕获文件的基本信息。

D:\Program Files (x86)\Wireshark>dir e:\file\Wireshark\analysisflags.pcapng
 驱动器 E 中的卷是 文档
 卷的序列号是 000F-D904

 e:\file\Wireshark 的目录

2016/03/01  19:31               228 analysisflags.pcapng
               1 个文件            228 字节
               0 个目录 13,510,852,608 可用字节