Sniffing/Analyzing network packets Using Wireshark

2. Sniffing/Analyzing
network packets Using
WiresharkSIS USING

3. History
●
Developed by Gerald Combs, in 1990s
●
Inititally called Ethereal
●
Written in C & C++
Why Wireshark:
➢
Open source
➢
Works on all major OS
➢
Operates in Graphical mode
➢
Easy usage
➢
Display filters
Don't forget tshark!

4. Features:
➢
Capture and analyze
➢
Wireless capture
➢
Display filters
➢
Intelligent scrollbar
➢
Color codes
➢
Customizable view
...and many more we would discuss in a bit.

5. Basic Layout
3 components:
➢
Packet list
➢
Packet details
➢
Packet bytes
Let's launch wireshark, shall we?

6. Columns
No The number of the packet in the capture file. This number won’t
change, even if a display filter is used.
Time The timestamp of the packet. The presentation format of this
timestamp can be changed.
Source The address where this packet is coming from.
Destination The address where this packet is going to.
Protocol The protocol name in a short (perhaps abbreviated) version.
Length The length of each packet. The maximum value would depend of
the MTU size.
Info Additional information about the packet content.
irony

7. Related Packet symbols

8. Display Filters(a few examples)
●
IP address
ip.addr eq 192.168.2.1
●
Ethernet Address
eth.addr eq 48:ee:0c:d7:c0:3c
●
Ethernet source address
eth.dst eq 48:ee:0c:d7:c0:3c
●
TCP or UDP port is 80
tcp.port == 80 || udp.port == 80
●
Non DNS
!(udp.port == 53 || tcp.port = 53)
●
Error detection
tcp.analysis.flags
●
Filtering packets involving any particular website:
tcp contains 9gag

9. Just so we are aware...

10. Errors to look out for
➔
TCP retransmissions
➔
Out of order
➔
Duplicate Acknowledgements
➔
Zero window

11. "[TCP Retransmission]" that usually indicates trouble - or at least potential trouble.
Cause: If a packet is lost for any reason it is retransmitted by the sender.
1. TCP retransmissions

12. Causes:
 Full Duplex / Half Duplex mismatch (check the configuration of the
network card and switch interfaces)
 The server transmits data with a high speed (say 1 GBit) and the
receiver is connected with a lower speed (say 100 MBit). Drops occur if
the receiver is signalling a large TCP window size, found in the TCP
header.
 Router is pushing the same packet again through a different MAC.
 A broken cable offers very poor signal quality.
 A wireless network is busy or suffers from interference.

14. Now what's SACK(SACK_PERM=1)

16. 2. Duplicate Acknowledgements
Duplicate ACKs are sent when the receiver sees a gap in the packets it
receives.
Used by fast retransmission feature to send missing packets soon, not
waiting for RTO.
Out of order (low number of dup acks)
Packet loss on the way (very high number of dup acks)

17. 3. Out of order
Incorrect sequence of received packets.
Sender never sends packets out of order.
They get mixed up on the way.
Cause:
Multiple paths between Source and destination, or not.
It is seen with Dup ACKs or SACKs

18. seq + Length = next seq

19. 4. Zero window
Cause:
Too many processes
CPU load
Think of its implication in UDP connection

20. Some other terminologies:
1. Delayed Ack: Not all data packets are followed by an ACK. It's cumulative.
2. TCP Keep-Alive: Client confirming if the connection is active.
3. Spurious retransmissions: Same data packet is received more than once.
4. Fast retransmissions: Sender retransmitting the lost packet
5. Time To Live(TTL): Remaining life time for a packet to float in a network
before it expires.

21. Thank you !!!