1 前言

一个问题，一篇文章，一出故事。
今天因为调试KeyCloak与LDAPs集成，由于需要分析是否是由于防火墙的连接造成通讯故障，因此需要使用软件抓包。
另外，本章节依赖以下章节，请提前熟悉以下章节，

如何在Windows用Wireshark dumpcap抓包？

如何在Linux用tcpdump抓包？

如何使用ldapsearch连接ldaps？

2 最佳实践

2.1 使用dumpcap命令在AD端监视请求

PS C:\Program Files\Wireshark> .\dumpcap.exe -i 4 -f "tcp port 636" -w C:\Users\Administrator\Downloads\ldaps.pcapng -t ad

可见如下显示，

Capturing on 'Ethernet0'
File: C:\Users\Administrator\Downloads\ldaps.pcapng
Packets captured: 4

另外，文件“C:\Users\Administrator\Downloads\ldaps.pcapng”用于分析，该文件在Linux环境可以使用如下命令读取，

tcpdump -nn -tt -r ldaps.pcapng

一般可见如下显示，

reading from file ldaps.pcapng, link-type EN10MB (Ethernet), snapshot length 262144
dropped privs to tcpdump
1784591940.880614 IP 10.168.208.186.34804 > 10.168.1.122.636: Flags [S], seq 1971546684, win 32120, options [mss 1460,sackOK,TS val 1840465773 ecr 0,nop,wscale 7], length 0
1784591940.880709 IP 10.168.1.122.636 > 10.168.208.186.34804: Flags [S.], seq 668217453, ack 1971546685, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
1784591940.891705 IP 10.168.208.186.34804 > 10.168.1.122.636: Flags [.], ack 1, win 251, length 0
1784591940.901003 IP 10.168.208.186.34804 > 10.168.1.122.636: Flags [R.], seq 1, ack 1, win 251, length 0

2.2 使用tcpdump命令在ldapsearch客户端抓包

tcpdump -nn -tt -i ens192 host dc01.cmdschool.org and port 636

可见如下显示，

dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens192, link-type EN10MB (Ethernet), snapshot length 262144 bytes
1784591940.908737 IP 10.168.208.186.34804 > 10.168.1.122.636: Flags [S], seq 1971546684, win 32120, options [mss 1460,sackOK,TS val 1840465773 ecr 0,nop,wscale 7], length 0
1784591940.920380 IP 10.168.1.122.636 > 10.168.208.186.34804: Flags [S.], seq 668217453, ack 1971546685, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
1784591940.920409 IP 10.168.208.186.34804 > 10.168.1.122.636: Flags [.], ack 1, win 251, length 0
1784591940.929293 IP 10.168.208.186.34804 > 10.168.1.122.636: Flags [P.], seq 1:341, ack 1, win 251, length 340
1784591940.929767 IP 10.168.1.122.636 > 10.168.208.186.34804: Flags [R.], seq 1, ack 341, win 251, length 0

2.3 使用ldapsearch客户端在客户发起请求

ldapsearch -d 1 -x -H ldaps://dc01.cmdschool.org:636 -w "adminpwd" -D "CN=admin,CN=Users,DC=cmdschool,DC=org" -b DC=cmdschool,DC=org "(&(sAMAccountName=will)(objectCategory=person))"