Wireshark Network Security: A succinct guide to securely administer your network using Wireshark

Packet sniffing is performed in order to better understand what flows through our networks. Just as a poison flowing through the veins of the human body has the potential to kill an individual, similarly malicious traffic traversing our networks can have a severe and sometimes irreparable effect on the network devices, performance, and business continuity.

Sniffing helps a network analyst verify whether the implementation and functionality of the network and network security devices, such as the router, switch, firewall, IDS, or IPS, are as expected and also confirms that data is traversing through secure channels of communication.

Security analysts use sniffing to gather evidence in the case of a security breach with regard to the source of the attack, time and duration of the attack, protocols and port numbers involved, and data transmitted for the purpose of the attack. It can also help to prove the use of any insecure protocol(s) used to transmit sensitive information.

As Christopher Hitchens, a British-born American author, was once quoted saying:

Using a packet sniffer helps us get that piece of evidence.

Now, to figure out whether the smell of the perfume is pleasant, ambrosial, or reeking is the analysis part. Hence, the art of interpreting and analyzing packets flowing through the network is known as packet analysis or network analysis. Mastering this art is a well-honed skill and can be achieved if a network administrator has a solid understanding of the TCP/IP protocol suite, is familiar with packet flows, and has an excellent grasp of any sniffer of choice.

Learning technology at the packet level helps to cement the most difficult concepts. For an easy example, let's say that a user wants to browse a website named example.com. As soon as the user enters the URL in the address bar and hits GO, the packets start to flow on the network with respect to that request. To understand this packet flow, we need to start sniffing to look at the packets in transit. The following screenshot shows the packets that traversed the network when the user opened example.com.

We can analyze the packets after capturing them using a sniffer of choice, and in our case, we notice the columns that tell us about the source and destination IP addresses, the protocol being used, the length of the individual packets, and other relevant information. We will be digging into more detailed analysis as we progress though this book.

When we talk about enterprise networks, at any given point, there is humongous amount of traffic on the wire and analyzing such traffic is not a walk in the park. This traffic may be generated by numerous network devices communicating among each other, servers responding to user requests, or making their own requests over the Internet when required, and end users trying to accomplish their day-to-day tasks at work. There is no better way to understand this flow of information than to perform a packet-level analysis and, as the famous quote about network analysis goes, packets never lie. In addition, Gerald Combs, the man behind Wireshark, once tweeted the following:

Learning such tricks comes only with experience, as with anything else in the field of IT. As an example, if you want to improve your programming skills, you have to practice code writing day in and day out to be able to write structured and optimized pieces of code that can perform magic. The same goes for packet analysis.

Packet analysis can further help an administrator to:

This contains the default title of Wireshark along with the current version in use. To enable or disable the title, navigate to Edit | Preferences | User Interface and modify the option Welcome screen and title bar shows version to suit your requirement. To modify the title, navigate to Edit | Preferences | User Interface | Layout and enter a suitable title in the Custom window title field as shown in the following figure:

The Menu bar hosts the features of Wireshark, all categorized under suitable titles. These options will be taken up as and when required during the course of this book. As an example, you can look at the authors involved in the development of Wireshark by navigating to Help | About Wireshark and selecting the Authors tab.

This is how it will look:

The main toolbar contains the icons for more frequently used items in Wireshark. You will note that some options are grayed out. This is because not all the options are available in the current context. Once we start the capture, we will see most of them highlighted and available for use.

Filtering the traffic can help analysts find a needle in a haystack. There are two types of filtering options available in Wireshark. One is called capture filters, and the second is called display filters.

Capture filters define which frames will be captured and sent to Wireshark's capture engine for processing and later displayed in Wireshark, while display filters define which frames are displayed after they are captured. We can redefine display filters without restarting the capture, which is not the case for capture filters; hence, we need to be cautious with their usage. The Expression option on the side helps us create the filter expressions in an easy way, as there is a huge list of filters, and we don't need to waste our time memorizing them.

Wireshark aids by providing visual indicators whether or not a filter used by us is correct (accepted by Wireshark), by changing the background color to red (wrong filter expression) and to green (correct filter expression) as shown in the following screenshot:

Wrong filter

This is the correct filter will look something like this:

Correct filter

Once the filter expression is ready, you can either press ENTER, or click on Apply for that filter to be applied on the selected list of packets, and you can remove the current filter expression by clicking on Clear.

After spending some time creating filters, you will notice that you are combining a lot of them using multiple AND (&&) and OR (||) statements and would also want to use the same filter expression in another capture file. For this purpose, you can save your filters in Wireshark, using the Save button at the extreme right of filter toolbar.

Filter to see only HTTP GET requests made by 192.168.20.130

This frame helps in identifying the interface to start capturing packets from and the associated options with those interfaces.

Here, at the capture frame, we have three ways to start capturing:

The following is how the Capture Help menu looks and later on we will see a description of the available options under this menu.

Here, we have two options that can help us with capturing using Wireshark in an efficient manner. Clicking on these options will redirect the user to:

The following is how the Files menu looks and later on we will see a description of the available options under this menu.

This menu provides options to:

As the name suggests, clicking on the options listed under this category redirects us to Wireshark's online resources.

The Status bar is used to display informational messages. It is divided into the following three sections: