Wireshark和Oracle TNS

wireshark是非常流行的开源软件，是网络封包分析软件，功能十分强大，可以放心使用。她可以截取各种网络封包，显示网络封包的详细信息。Wireshark使用WinPCAP作为接口，直接与网卡进行数据报文交换。为了安全考虑，wireshark只能查看封包，而不能修改封包的内容，或者发送封包。其中wireshark中还包含了Oracle TNS的信息，通过这个还可以解析Oracle网络传输的东西，做安全审计方面的工具。wireshark官方下载网站：https://www.wireshark.org/

TNS (Transparent Network Substrate):
https://anonsvn.wireshark.org/wireshark/trunk-1.8/epan/dissectors/packet-tns.c
https://anonsvn.wireshark.org/wireshark/trunk-1.8/epan/dissectors/packet-tns.h

TTC (Two-Task Common):
http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-sqloracle.c
http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-sqloracle.h 

TNS也是基于OSI七层模型的

Reference

https://docs.oracle.com/en/database/oracle/oracle-database/18/netag/understanding-communication-layers.html

https://github.com/wireshark/wireshark

https://www.wireshark.org/develop.html
https://anonsvn.wireshark.org/wireshark/
http://www.skynet.ie/~colinmac/Programming/port_listing.html
https://blog.pythian.com/repost-oracle-protocol/
http://www.nyoug.org/Presentations/2008/Sep/Harris_Listening%20In.pdf
https://anonsvn.wireshark.org/wireshark/trunk-1.8/epan/dissectors/
https://anonsvn.wireshark.org/wireshark/trunk-1.8/epan/dissectors/packet-sqloracle.c
https://anonsvn.wireshark.org/wireshark/trunk-1.8/epan/dissectors/packet-sqloracle.h

http://www.nyoug.org/Presentations/SIG/DBA/Tanel_Poder_advanced_oracle_troubleshooting.pdf

https://blog.pythian.com/repost-oracle-protocol/

http://www.oracleforensics.com/wordpress/wp-content/uploads/2007/03/OracleForensicsInANutshell.pdf