请问关于wireshark扫描

死海文书

使用wireshark扫描我Vmware里面的系统端口命令及输出如下
============================================
C:\>nmap -sT -v 192.168.0.58
Starting Nmap 5.51 at 2011-07-21 15:30 中国标准时间
Initiating ARP Ping Scan at 15:30
Scanning 192.168.0.58 [1 port]
Completed ARP Ping Scan at 15:30, 0.17s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:30
Completed Parallel DNS resolution of 1 host. at 15:30, 0.31s elapsed
Initiating Connect Scan at 15:30
Scanning 192.168.0.58 [1000 ports]
Discovered open port 21/tcp on 192.168.0.58
Discovered open port 135/tcp on 192.168.0.58
Discovered open port 139/tcp on 192.168.0.58
Increasing send delay for 192.168.0.58 from 0 to 5 due to 11 out of 16 dropped p
robes since last increase.
Connect Scan Timing: About 22.10% done; ETC: 15:33 (0:01:49 remaining)
Increasing send delay for 192.168.0.58 from 5 to 10 due to 11 out of 15 dropped
probes since last increase.
Increasing send delay for 192.168.0.58 from 10 to 20 due to 11 out of 12 dropped
probes since last increase.
Connect Scan Timing: About 44.05% done; ETC: 15:33 (0:01:21 remaining)
Completed Connect Scan at 15:32, 99.28s elapsed (1000 total ports)
Nmap scan report for 192.168.0.58
Host is up (0.00s latency).
Not shown: 997 filtered ports
PORT    STATE SERVICE
21/tcp  open  ftp
135/tcp open  msrpc
139/tcp open  netbios-ssn
MAC Address: 00:0C:29:2E:01:A3 (VMware)
Read data files from: D:\ProgramFiles\Nmap
Nmap done: 1 IP address (1 host up) scanned in 99.89 seconds
           Raw packets sent: 1 (28B) | Rcvd: 1 (28B)

===============================================
但是我得到的数据包都是从51到58的呢.具体见附件

菜鸟人飞

楼主你是在机器上使用nmap扫描192.168.0.58的开放端口，同时用wireshark抓取扫描的数据包。
我不明确你的问题是什么，试着猜一下，你的疑问是数据包都是从51-58，没有达到64吗？
如果是，继续看下面回答，如果不是，直接跳过。

正常情况下，使用nmap扫描端口的数据包，都是小包，nmap发出时没有64个字节。如果需要将这种包发往网络中，网卡会对其进行填充，以达到最小的64字节长度。你抓包的位置，在nmap和网卡之间，数据包还未来得及填实，就被wireshark抓到了，所以出现51-58。