Search icon
Subscription
0
Cart icon
Close icon
You have no products in your basket yet
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletters
Free Learning
Arrow right icon
Wireshark Network Security
Wireshark Network Security

Wireshark Network Security: A succinct guide to securely administer your network using Wireshark

By Piyush Verma
$35.99 $24.99
Book Jul 2015 138 pages 1st Edition
eBook
$35.99 $24.99
Print
$43.99
Subscription
$15.99 Monthly
eBook
$35.99 $24.99
Print
$43.99
Subscription
$15.99 Monthly

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now

Product Details


Publication date : Jul 29, 2015
Length 138 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781784393335
Table of content icon View table of contents Preview book icon Preview Book

Wireshark Network Security

Chapter 1. Getting Started with Wireshark – What, Why, and How?

Sniffing and interpreting traffic on the network has been and always will be an integral part of a network analyst's job profile. It is not only restricted to the network analyst's profession, but it also plays a significant role in the fields of software development, network security, and digital forensics. Wireshark is the tool of choice at most workplaces and does not seem to slow down in terms of popularity and features, hence making it a "must-know" tool. This chapter gives a briefing on:

  • Sniffing and its purpose

  • Tools of the trade

  • Getting up and running with Wireshark

Sniffing


Sniffing, by definition, is using our sense of smell to savor something, like a sniff of perfume. In this case, our nose acts as a sniffer. We can perform sniffing on the network using various tools categorized as packet sniffers to capture or collect the packets flowing in our networks. They are simply a way for us to see the network traffic and bandwidth information over the entire IT infrastructure. The technique of using a packet sniffer to sniff the data flowing over the wire or through thin air (wireless) is called packet sniffing.

The purpose of sniffing

Packet sniffing is performed in order to better understand what flows through our networks. Just as a poison flowing through the veins of the human body has the potential to kill an individual, similarly malicious traffic traversing our networks can have a severe and sometimes irreparable effect on the network devices, performance, and business continuity.

Sniffing helps a network analyst verify whether the implementation and functionality of the network and network security devices, such as the router, switch, firewall, IDS, or IPS, are as expected and also confirms that data is traversing through secure channels of communication.

Security analysts use sniffing to gather evidence in the case of a security breach with regard to the source of the attack, time and duration of the attack, protocols and port numbers involved, and data transmitted for the purpose of the attack. It can also help to prove the use of any insecure protocol(s) used to transmit sensitive information.

As Christopher Hitchens, a British-born American author, was once quoted saying:

"That which can be asserted without evidence, can be dismissed without evidence."

Using a packet sniffer helps us get that piece of evidence.

Packet analysis

Now, to figure out whether the smell of the perfume is pleasant, ambrosial, or reeking is the analysis part. Hence, the art of interpreting and analyzing packets flowing through the network is known as packet analysis or network analysis. Mastering this art is a well-honed skill and can be achieved if a network administrator has a solid understanding of the TCP/IP protocol suite, is familiar with packet flows, and has an excellent grasp of any sniffer of choice.

Learning technology at the packet level helps to cement the most difficult concepts. For an easy example, let's say that a user wants to browse a website named example.com. As soon as the user enters the URL in the address bar and hits GO, the packets start to flow on the network with respect to that request. To understand this packet flow, we need to start sniffing to look at the packets in transit. The following screenshot shows the packets that traversed the network when the user opened example.com.

We can analyze the packets after capturing them using a sniffer of choice, and in our case, we notice the columns that tell us about the source and destination IP addresses, the protocol being used, the length of the individual packets, and other relevant information. We will be digging into more detailed analysis as we progress though this book.

When we talk about enterprise networks, at any given point, there is humongous amount of traffic on the wire and analyzing such traffic is not a walk in the park. This traffic may be generated by numerous network devices communicating among each other, servers responding to user requests, or making their own requests over the Internet when required, and end users trying to accomplish their day-to-day tasks at work. There is no better way to understand this flow of information than to perform a packet-level analysis and, as the famous quote about network analysis goes, packets never lie. In addition, Gerald Combs, the man behind Wireshark, once tweeted the following:

""The packets never lie" but as traffic volumes increase you end up with a trillion truths. The trick is finding the important ones."

Learning such tricks comes only with experience, as with anything else in the field of IT. As an example, if you want to improve your programming skills, you have to practice code writing day in and day out to be able to write structured and optimized pieces of code that can perform magic. The same goes for packet analysis.

Packet analysis can further help an administrator to:

  • Monitor and provide a detailed statistics of activities on the network

  • Distinguish between normal and unusual traffic

  • Perform network diagnostics

  • Identify and resolve network performance issues such as excessive bandwidth utilization

  • Conduct deep packet inspection

  • Investigate security breaches

The tools of the trade


There are numerous free and commercial packet sniffers, very often named network analyzers, in the market, and selecting the one that best meets your need is a matter of choice. There are several factors to determine this, such as the operating system in use, supported set of protocols, ease of use, customizability, and of course budget. The following are the popular ones:

  • Tcpdump: Tcpdump is a free and popular command-line packet capture utility, which can come in very handy in the absence of a GUI-based tool. However, even after capturing traffic via tcpdump, one can analyze and interpret the traffic using any GUI-based free or commercial tool, as it is visually easy. Refer to TCPDUMP Overview at http://www.tcpdump.org/manpages/tcpdump.1.html.

  • Nagios Network Analyzer and OmniPeek: These are commercial-grade network analyzers that provide organizations with packet analysis capabilities with some unique features of their own. The pricing for these products can be seen on their individual websites.

  • Wireshark: Wireshark, formerly known as Ethereal, is free and open source, and is the most popular packet analyzer out there. It works across multiple platforms and supports a huge set of protocol families with an easy-to-use GUI. Refer to http://wiki.wireshark.org/ProtocolReference/.

Apart from the dedicated sniffer tools we just introduced, packet sniffing capability and modules come integrated in many of the popular security-related tools, such as Snort, Metasploit, and Scapy, to name a few. Snort started off as a sniffer and later used its sniffing capabilities to develop into what we know today as the popular network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) solution.

Another example is the presence of the sniffer module in Metasploit. After successfully compromising a machine using Metasploit, one can execute this module and start sniffing traffic on that compromised box for further enumeration. Sniffing options available with Metasploit are shown as follows:

Another excellent option is using sniff() in Scapy. Scapy is a packet manipulation tool written in Python and can be used to generate, craft, and decode packets and capture them. It is helpful in many security testing-related activities.

The focus of this book is "Wireshark". So, let's get started.

What is Wireshark?


Wireshark, as discussed earlier, is the most popular packet analyzer, and there is a reason behind its huge fan following. It hosts tons of features, supports a huge list of common and uncommon protocols with an easy-to-navigate GUI, and can be easily installed and used on popular operating systems, such as Windows, Linux, and Mac OS X for absolutely no cost at all.

Wireshark can be downloaded and installed from the official website (http://www.wireshark.org). The installation setup is comparatively simple, and within a few clicks, you will be up and running with Wireshark on a Windows machine.

Note

Installation guidelines for Windows, Unix, and Mac OS X can be found at https://www.wireshark.org/docs/wsug_html_chunked/ChapterBuildInstall.html.

As of writing this, the most recent version is Wireshark 1.12.6. Once downloaded and installed, you should be able to start Wireshark and will be presented with a screen similar to the one shown here:

The Wireshark interface – Before starting the capture


Let's get started with various aspects of the Wireshark interface.

Title

This contains the default title of Wireshark along with the current version in use. To enable or disable the title, navigate to Edit | Preferences | User Interface and modify the option Welcome screen and title bar shows version to suit your requirement. To modify the title, navigate to Edit | Preferences | User Interface | Layout and enter a suitable title in the Custom window title field as shown in the following figure:

Note

Note: This will be appended to the current title as shown in the preceding screenshot.

Menu

The Menu bar hosts the features of Wireshark, all categorized under suitable titles. These options will be taken up as and when required during the course of this book. As an example, you can look at the authors involved in the development of Wireshark by navigating to Help | About Wireshark and selecting the Authors tab.

This is how it will look:

Main toolbar

The main toolbar contains the icons for more frequently used items in Wireshark. You will note that some options are grayed out. This is because not all the options are available in the current context. Once we start the capture, we will see most of them highlighted and available for use.

Filter toolbar

Filtering the traffic can help analysts find a needle in a haystack. There are two types of filtering options available in Wireshark. One is called capture filters, and the second is called display filters.

Capture filters define which frames will be captured and sent to Wireshark's capture engine for processing and later displayed in Wireshark, while display filters define which frames are displayed after they are captured. We can redefine display filters without restarting the capture, which is not the case for capture filters; hence, we need to be cautious with their usage. The Expression option on the side helps us create the filter expressions in an easy way, as there is a huge list of filters, and we don't need to waste our time memorizing them.

Wireshark aids by providing visual indicators whether or not a filter used by us is correct (accepted by Wireshark), by changing the background color to red (wrong filter expression) and to green (correct filter expression) as shown in the following screenshot:

Wrong filter

This is the correct filter will look something like this:

Correct filter

Note

You may notice that sometimes the filter shows a yellow background. This might be due to the fact that the filter expression which you entered is not working as expected. An example could be using instead of the correct filter, that is, .

Once the filter expression is ready, you can either press ENTER, or click on Apply for that filter to be applied on the selected list of packets, and you can remove the current filter expression by clicking on Clear.

Note

Applying display filters on a large capture might take some time, and the progress is visible.

After spending some time creating filters, you will notice that you are combining a lot of them using multiple AND (&&) and OR (||) statements and would also want to use the same filter expression in another capture file. For this purpose, you can save your filters in Wireshark, using the Save button at the extreme right of filter toolbar.

Filter to see only HTTP GET requests made by 192.168.20.130

Capture frame

This frame helps in identifying the interface to start capturing packets from and the associated options with those interfaces.

Here, at the capture frame, we have three ways to start capturing:

  • Interface List: If you're not sure about the active interface to use for capture, selecting this option is a good choice as it gives you a complete list of the available interfaces, IP addresses in use, and the number of packets transmitted per interface. Using this information, we can easily figure out which interface to use to capture traffic.

    Simply the interface, and click on Start to begin the capture.

    Note

    You may choose to click on Options before starting the capture. However, this will open the same capture options discussed in Capture Options.

  • Start: This is the simplest and quickest way to start the capture if you know the network interface(s) in question. All you need to do is select the interface(s) from the available list of interfaces and click on Start.

  • Capture Options: This is an advanced way to start a capture, as it provides tweaking capabilities before a capture is even started.

    Here you can an individual interface to capture or Capture on all interfaces, to do exactly what it says.

    By clicking on Capture Filter, you can select/create any filter before capturing begins. After this, you have some options that can be tweaked to perform unattended captures. For example, we want to create multiple files of 200 KB and stop the capture automatically after 2 minutes. The following screenshot shows how this is done:

    Configuring for multiple files

    The following are the resultant files:

    Multiple files

Note

Wireshark saves the filename in FileName_FileNumber_YEARMMDDHRMINSEC.pcap format.

For details regarding the other options on this frame please go to https://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureOptions.html.

Capture Help

The following is how the Capture Help menu looks and later on we will see a description of the available options under this menu.

Here, we have two options that can help us with capturing using Wireshark in an efficient manner. Clicking on these options will redirect the user to:

The Files menu

The following is how the Files menu looks and later on we will see a description of the available options under this menu.

This menu provides options to:

  1. Browse and open an already captured trace file.

  2. Click and open any recently opened file. The number of recent files to be listed here can be modified by going to Edit | Preferences | User Interface and then editing the Maximum recent files option to the value of choice.

  3. Download sample capture files available at the official site (http://wiki.wireshark.org/SampleCaptures).

Online

As the name suggests, clicking on the options listed under this category redirects us to Wireshark's online resources.

The Status bar

The Status bar is used to display informational messages. It is divided into the following three sections:

  • The left side of the Status bar shows context-related information, which includes the colorized bullet indicating the current expert-info level and an option to edit or add capture comments.

  • The middle part shows the current number of packets and the load time.

  • The right side of the Status bar shows the current configuration profile in use. By default, there are three profiles present [Default, Bluetooth, and Classic], and one can always create and use new configuration profiles as required.

    Status bar

First packet capture


Let's get started with our first packet capture using Wireshark by following these steps:

  1. Launch Wireshark

  2. Select the correct interface to capture traffic. This can be done by navigating to the Menu bar and clicking on Capture | Interfaces (As a shortcut, we may choose Ctrl + I). Once we have the Wireshark: Capture Interfaces window open, perform the following steps:

    1. Select the Internet-facing interface (for example, Wi-Fi in my case). A good indication of the active interface is the Packets and Packets/s column on the right-hand side of the window as shown in the following screenshot:

    2. After selecting the interface, click on the Options button, as highlighted in the screenshot, and the Wireshark: Capture Options window pops up as shown in the following screenshot:

      Tip

      Enter host example.com in the Capture Filter field, as we only want to capture traffic to and from the domain example.com, and click on the ENTER key. We will discuss capture filters in detail in the next chapter.

  3. The next step is to let Wireshark run in the background and open a browser of your choice (for example, Mozilla Firefox in my case) and browse example.com.

  4. Once example.com loads, navigate to Wireshark, and stop the packet capture, by clicking on the Stop button in the main toolbar.

    Once stopped, the capture appears as shown in the following screenshot:

    In the preceding screenshot, we can see Wireshark's menu bar, main toolbar and filter toolbar followed by three different panes and the Status bar. The three panes are as follows:

    1. Packet List pane: This pane reflects the packets captured by Wireshark and some basic details about those packets. For example, the first packet in our capture is an SYN packet of the three-way handshake from the client to the server.

      Note

      Please note that the packets displayed under this pane could be affected by the display filter, if any, used in the filter toolbar.

    2. Packet Details pane: If we select any packet in the Packet List pane, its details are shown under this pane. For example, after selecting the first packet in our capture, we can look at the packet at a more granular level, that is, the changes it undergoes at different layers of networking (for example, source and destination ports under the Transmission Control Protocol (TCP), that is, the Transport layer of the TCP/IP model).

      This pane shows the protocols and protocol fields in a tree format and also displays any links when the current packet in question has a relationship to another packet in the same capture (for example, a request and response relationship for a single communication).

    3. Packet Bytes pane: This pane displays the bytes of the selected packet in a hex dump format and is affected by what is selected in the previous pane, that is, the Packet Details pane.

  5. The final step is to save the captured packets. We can do this by navigating to the menu bar, clicking on File | Save and saving it with an appropriate name in the directory of your choice.

Congratulations! With this, we have successfully captured and saved our first trace file.

Summary


In this chapter, we went over the foundations of sniffing and its practical importance in the real world, the different tools available at our disposal to perform sniffing, and understanding the Wireshark GUI to quickly get started with sniffing and perform our first packet capture. We shall begin the analysis part in the next chapter.

Left arrow icon Right arrow icon

Key benefits

What you will learn

Familiarize yourself with the robust features offered by Wireshark Use the powerful commandline utilities shipped with Wireshark Analyze numerous threats to network security using Wireshark Investigate attacks performed using popular security tools such as Nmap, Nessus, Metasploit, and more Solve realworld CTF challenges using Wireshark Create your own securityrelated profile in Wireshark Configure Wireshark for effective network troubleshooting Get accustomed to common scenarios faced by security analysts Analyze malware traffic successfully by using Wireshark Unearth anomalies hampering the speed of network communications

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now

Product Details


Publication date : Jul 29, 2015
Length 138 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781784393335

Table of Contents

14 Chapters
Wireshark Network Security Chevron down icon Chevron up icon
Credits Chevron down icon Chevron up icon
About the Author Chevron down icon Chevron up icon
Acknowledgment Chevron down icon Chevron up icon
About the Reviewers Chevron down icon Chevron up icon
www.PacktPub.com Chevron down icon Chevron up icon
Preface Chevron down icon Chevron up icon
1. Getting Started with Wireshark – What, Why, and How? Chevron down icon Chevron up icon
2. Tweaking Wireshark Chevron down icon Chevron up icon
3. Analyzing Threats to LAN Security Chevron down icon Chevron up icon
4. Probing E-mail Communications Chevron down icon Chevron up icon
5. Inspecting Malware Traffic Chevron down icon Chevron up icon
6. Network Performance Analysis Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon

Customer reviews

Filter icon Filter
Top Reviews
Rating distribution
Empty star icon Empty star icon Empty star icon Empty star icon Empty star icon 0
(0 Ratings)
5 star 0%
4 star 0%
3 star 0%
2 star 0%
1 star 0%

Filter reviews by


No reviews found
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

How do I buy and download an eBook? Chevron down icon Chevron up icon

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

  • You may make copies of your eBook for your own use onto any machine
  • You may not pass copies of the eBook on to anyone else
How can I make a purchase on your website? Chevron down icon Chevron up icon

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

  1. Register on our website using your email address and the password.
  2. Search for the title by name or ISBN using the search option.
  3. Select the title you want to purchase.
  4. Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title. 
  5. Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)
Where can I access support around an eBook? Chevron down icon Chevron up icon
  • If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
  • To view the errata for the book, see www.packtpub.com/support and view the pages for the title you have.
  • To view your account details or to download a new copy of the book go to www.packtpub.com/account
  • To contact us directly if a problem is not resolved, use www.packtpub.com/contact-us
What eBook formats do Packt support? Chevron down icon Chevron up icon

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks? Chevron down icon Chevron up icon
  • You can get the information you need immediately
  • You can easily take them with you on a laptop
  • You can download them an unlimited number of times
  • You can print them out
  • They are copy-paste enabled
  • They are searchable
  • There is no password protection
  • They are lower price than print
  • They save resources and space
What is an eBook? Chevron down icon Chevron up icon

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.