This document summarizes a technical workshop on network packet analysis presented by Ahmad Muammar W.K. OSCP. The workshop covers capturing and analyzing network traffic at different levels, from examining protocol fields to reconstructing files. Challenges like encrypted traffic and incorrect protocol dissection are also discussed. Various Wireshark features are demonstrated including capture and display filters, protocol decoding, and reconstructing files transmitted over non-standard ports.

1. Network Packet
Analysis (basic)
Technical Workshop (25 Oktober 2012)
Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

2. Introduction
• A.K.A y3dips
• Pro. Bandwidth Hunter
• IT(Sec) Consultant/Pentester/py.Coder
• Founder echo.or.id, ubuntu-id, idsecconf
• @y3dips, me@ammar.web.id
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

3. Packet Analysis
• Captured Network Traffic
• Analyze the protocols, carve out the files,
search for strings
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

4. Packet Analysis
• Analyze fileds within protocols
• Analyze Protocols within packets
• Analyze Packets within streams
• Reconstruct higher-layer protocols
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

5. Issue Found
• Too many stream packet
• Packet corrupted or truncated
• Contents encrypted at different layers
• Unstandard protocols
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

6. Protocol Analysis
• Examination of one or more fields within
the protocol’s data structure.
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

7. Packet Analysis
• Packet Analysis
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

8. WiresharkWorkshop
Network Packet Analysis Technical
(25 Oktober 2012)
Ahmad Muammar W.K. OSCP
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

9. WireShark
Advance Usage
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

10. Wireshark Display
• Packet List
• Packet Details
• Packet Bytes
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

11. Packet List
Packet List
Packet Details
Packet Bytes
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

12. Wireshark
Coloring Rules
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

13. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

14. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

15. Wireshark
Capture Filters
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

16. Capture Filters
for the shake of the performance
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

17. Capture/BPF syntax
• Type: host, net, port
• Direction: src, dst
• Proto: ether, ip, tcp, udp
• Logical oepration: &&, ||, !
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

18. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

19. Capture Filters
• Filtering the host
• host ipv4/ipv6
• host hostname
• ether host mac (00-11-22-33-44-55)
• src/dst host 192.168.1.1
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

20. Capture Filters
• Filtering the Protocol/Port
• port 443
• !port 443
• protocol name (e.g: icmp)
• !protocol name (e.g !icmp)
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

21. Capture Filters
• Protocol Field
• icmp[0] == 3 (unreachable)
• icmp[0] == 8 (echo request)
• tcp[13] & 4 == 4 (RST)
• tcp[13] & 1 == 1 (FIN)
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

22. Display Filters
See only what you wanna see
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

23. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

24. Display Filters
• !tcp.port=443
• tcp.flag.syn=1
• !arp
• tcp.port==21 || tcp.port==23
• smtp || pop || imap
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

25. Packet Analysis
Wrong Dissector
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

26. Protocol Dissector
• Allow Wireshark to automatically break
down into various section so that it can
be analyzed
• Translator, decoder
• Not work for non-standard/default port.
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

27. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

28. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

29. Wrong Dissector
• So its an SSL traffic
• But, why we able to see all info
• FTP Traffic using port 443?
• Decode it with FTP
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

30. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

31. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

32. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

33. Packet Analysis
Reconstruct File and Data
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

34. Reconstruct Data
• nc -lv 110 > confidential.pdf
• nc -vv 192.168.1.222 110 <
confidential.pdf
• non standard port send pdf and zip
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

35. Packet Analysis
Reconstruct PDF File
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

36. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

37. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

38. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

39. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

40. Packet Analysis
Reconstruct Zip File from NC file transfer
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

41. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

42. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

43. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

44. Packet Analysis
Reconstruct Zip File from FTP server
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

45. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

46. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

47. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

48. Packet Analysis
Decrypting and decode ssl packet
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

49. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

50. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

51. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

52. Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13

53. Network Packet
Analysis
Technical Workshop (25 Oktober 2012)
Ahmad Muammar W.K. OSCP
Network Packet Analysis - Ahmad Muammar W.K. OSCP
Tuesday, January 22, 13