Network analysis Using Wireshark Lesson 3: locating wireshark

Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 1
Lesson 3 – Locating Wireshark
Network analysis Using Wireshark
Lesson 3:
Wireshark Basics

• By the end of this lesson, the participant will be able to:
▫ Understand Port-mirror and Taps
▫ Understand how to locate Wireshark in the networks for best
monitoring
Lesson Objectives

yoram@ndi-com.com
For More lectures, Courses & Keynote Speaking
Contact Me to:

L2/L3 network operation
Where to locate Wireshark
Taps and port-mirror
Local and remote monitoring
Capture data from multiple interfaces
Capture data on virtual machines
Chapter Content
“You only live once, but if you do it
right, once is enough.”
Mae West

Reminder – How a LAN Switch Works
Sw
Segment A
Segment B
B3
A1 A2 A3
B2B1
A1
A2
A3
B1
B2
B3
C5
C6
C7
C5
C6
C7
Segment C
Decision Table
A1A3 Block
A1B1 Forward to port B
A1C7 Forward to port C
A1BC Forward to all (flood)
A1D7 Forward to all (flood)

The Big Picture
SA: M1
SA: M1
SA: M1
SA: M1
SA: M1
SA: M1
SA: M1
Frame send
To M1
DA: M1
DA: M1
DA: M1
DA: M1
DA: M1
DA: M1
M – MAC Address
SA – Source (MAC) address
DA – Destination (MAC) address
SW1
Broadcast
sent
SW4SW3SW2
SW5 SW6 SW7
1
SA: M1 SA: M1
SA: M1
SA: M1
2

The Big Picture
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
SA: M1
SA: M1
SA: M1
SA: M1
SA: M1
SA: M1
SA: M1
Frame send
To M1
DA: M1
DA: M1
DA: M1
DA: M1
DA: M1
DA: M1
M – MAC Address
SA – Source (MAC) address
DA – Destination (MAC) address
1 2 3 4 5 6 7 8
SW1
Broadcast
sent
SW4SW3SW2
SW5 SW6 SW7
1
SA: M1 SA: M1
SA: M1
SA: M1
2
To ISP

Chapter Content
“The real danger is not that computers will
begin to think like men, but that men will
begin to think like computers.”
Sydney Harris

Were to Locate the Wireshark?
To ISP
For server monitoring:
Connect the laptop to the LAN
switch, with port mirror to the
monitored server
For WAN monitoring:
Connect the laptop to the LAN
switch, with port mirror to the
monitored router
For Internet connectivity
monitoring:
Before or after the Firewall
Remote office monitoring:
On the WAN side
Remote office monitoring:
On the LAN side

Chapter Content
“Live as if you were to die tomorrow. Learn as if
you were to live forever.”
Mahatma Gandhi

Port Mirror / Port Monitor
Monitoring
port
SDSD SD SD
Monitored
port

Double Vision – What Happened Here?

TAP (Test Access Point)
http://www.fullcontrolnetworks.co.uk/faq-category/popular-questions/

Chapter Content
“To live is the rarest thing in the world. Most
people exist, that is all.”
Oscar Wilde

Local Monitoring
• Choose the interface
• Configure capture filter (optional)
• Start capture of data

• From Menu  Options:
• Choose Manage Interfaces…
Remote Monitoring (1) – On Local machine

Remote Monitoring (2) – On Local Machine
• You get the following window
• Choose Remote Interfaces…

Remote Monitoring (3) – On Local machine
• You will get the following window
• Click on the (+) icon, and the following
window opens
• Configure Host IP/Name of the remote
machine

• Install Winpcap on the
remote PCs
▫ Configure the firewall so
that TCP port 2002 will be
accessible from your
machine
• Add a user to the PC user
list, give it a password, and
administrator privileges.
Remote Monitoring (4) - On Remote machine

• Start the Remote Packet Capture Protocol service
• Write-click on the Start symbol down left the Windows
screen, choose Open Windows Explorer, right-click on
Computer and choose Manage.
Remote Monitoring (5) - On Remote machine

Chapter Content
“A friend is someone who knows all about you
and still loves you.”
Elbert Hubbard

Capture Data from Multiple Interfaces

Chapter Content
“Any fool can know. The point is to understand.”
Albert Einstein

HW
Virtualization
Software
Guest
OS 1
Guest
OS 2
Guest
OS 3
App
External LAN Switch
1 2 3 4
7 8 9 10
5 6
11 12
NIC1 NIC2
A
p
p
A
p
p
App
What is a Virtual Machine
And How to monitor Traffic to it
1. Port mirror from LAG (ports 1/2)
to port 7 that the laptop is
connected to
2. Two port mirrors (1 to 8, 2 to 9)
with capture from multiple
interfaces
1 2

Connecting to a Blade Center
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
. .
.
Internal LAN Switch
Ext 1 Ext 2 Ext 3 Ext 4
Int1 Int2 Int3 Int4 Int5 Int6 Int7 Int8
Internal LAN Switch
BLADE
Center
External LAN Switch
1 2 3 4
7 8 9 10
5 6
11 12
External LAN Switch
1 2 3 4
7 8 9 10
5 6
11 12
To organization network
S – Server
SB – Server Blade
Eth – Ethernet
Int – Internal
Ext - External
SB-1 SB-2 SB-3 SB-4 SB-5 SB-6
S
2
S
2
S5
S
3
S6
S
4
S
7
S
8
1
2
3

Monitoring a Blade Center
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
Eth1
Eth2
. .
.
Internal LAN Switch
Internal LAN Switch
BLADE
Center
External LAN Switch
1 2 3 4
7 8 9 10
5 6
11 12
External LAN Switch
1 2 3 4
7 8 9 10
5 6
11 12
To organization network
S – Server
SB – Server Blade
Eth – Ethernet
Int – Internal
Ext - External
SB-1 SB-2 SB-3 SB-4 SB-5 SB-6
S
2
S
2
S5
S
3
S6
S
4
S
7
S
8
1

Summary
• In this lesson we talked about:
▫ Where to locate Wireshark in the network
▫ How to use taps and port mirror
▫ How to use Wireshark in virtual environment
Thanks for your time
Yoram Orzach
yoram@ndi-com.com

yoram@ndi-com.com
For More lectures, Courses & Keynote Speaking
Contact Me to:

Network analysis Using Wireshark Lesson 3: locating wireshark

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Network analysis Using Wireshark Lesson 3: locating wireshark

Similar to Network analysis Using Wireshark Lesson 3: locating wireshark (20)

More from Yoram Orzach

More from Yoram Orzach (9)

Recently uploaded

Recently uploaded (20)

Network analysis Using Wireshark Lesson 3: locating wireshark