Presented in TEIN Application Workshop 2017 organised by Department of Computer Science and Engineering, University of Dhaka.

1. Wireshark
Drinking straight from the network hose
Md. Abdul Awal
BdREN
awal@bdren.net.bd
TEIN Application Workshop 2017
University of Dhaka
December 11, 2017
These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0
International license. https://creativecommons.org/licenses/by-nc/4.0/

2. Agenda
• Wireshark Intro
• Monitoring port using Wireshark
• Demo/Lab
• Discussion
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 2

3. Motivation for Network Monitoring
• Essential for Network Management
• Router and Firewall policy
• Detecting abnormal/error in networking
• Access control
• Security Management
• Detecting abnormal traffic
• Traffic log for future forensic analysis
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 3

4. What is Wireshark?
• Packet sniffer/protocol analyzer
• Open Source Network Tool
• Latest version of the ethereal tool
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 4

5. Installation
• Windows/MacOS Download:
https://www.wireshark.org/#download
• Linux:
CentOS – yum install wireshark
Ubuntu – apt-get install wireshark
Red Hat – rpm –iv wireshark*rpm
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 5

6. Wireshark Interface
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 6
Command Menu
Display Filter Menu
Captured Packet List
Selected Packet’s Info
Packet’s Content in
ASCII and Hex Format
Status Bar

7. Where do I put the Wireshark?

8. Hub
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 8

9. Switch
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 9

10. Switch with SPAN Port
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 10

11. Tap
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 11

12. Lab 1
• Open Wireshark
• Select your LAN/WLAN interface to capture traffic
• Select to stop Wireshark after 5MB
• Run Capture
• Open your browser and log on to tein.asia
• Ping tein.asia to identify the IP address
• Find the IP from the captured packets
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 12

13. Display Filter (Post Filter)
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 13

14. Display Filter Examples
• ip.src == 10.1.11.24
• ip.addr == 192.168.1.10 && ip.addr==192.168.1.20
• tcp.dstport== 80
• tcp.port == 80 || tcp.port == 3389
• !(ip.addr == 192.168.1.10 && ip.addr == 192.168.1.20)
• (ip.addr == 192.168.1.10 && ip.addr == 192.168.1.20)
&& (tcp.port == 445 || tcp.port == 139)
• (ip.addr == 192.168.1.10 && ip.addr == 192.168.1.20)
&& (udp.port == 67 || udp.port == 68)
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 14

15. Statistics>Protocol Hierarchy
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 15

16. Export HTTP Object
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 16

17. Analyze>Follow>TCP Stream
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 17
RED:
Stuff you sent
BLUE:
Stuff you get

18. Statistics>Conversations
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 18

19. Statistics>Flow Graph
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 19

20. Statistics>Packet Lengths
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 20

21. Statistics>TCP Stream Graphs>RTT
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 21

22. Lab 2
• Open GNS3 and prepare the following lab
• Configure interfaces with IP addresses
• Configure VTY interface for telnet
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 22

23. Example: R2
interface fa0/0
no shutdown
ip address 10.10.10.2 255.255.255.252
!
line vty 0 4
password abc123
login
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 23

24. Open Wireshark
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 24

25. Ping R2 from R1
ping 10.10.10.2 repeat 50
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 25

26. Telnet to R2 from R1
telnet 10.10.10.2
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 26

27. Analyze>Follow>TCP Stream
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 27

28. Homework
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 28
Do it for SSH

29. Improve Wireshark Performance
• Don’t use capture filters
• Increase your read buffer size
• Get a faster computer
• Use a TAP
• Don’t resolve names
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 29

30. Questions?
TEIN Application Workshop 2017, University of Dhakaawal@bdren.net.bd 30