Practical 7 - Using Wireshark Tutorial and Hands-on

1. Capture, Filter, and Inspect
Network Packets
Practical 7
Dr. Qais Saif Qassim

2. Outline
• What is Wireshark?
• Capturing Packets
• Analyzing Packets
• Filtering Packets
• Saving and Manipulating Packets
• Packet Statistics
• Useful references

3. What is Wireshark?
• Wireshark is a network packet analyzer.
• A network packet analyzer captures network packets and
displays that packet data as detailed as possible.
• The De-Facto Network Protocol Analyzer
• Open-Source
• Multi-platform
• Easily extensible
• Large development group
• Previously Named “Ethereal”

4. What is Wireshark?
Receives a copy of every link-layer frame that i
s sent from or received by your computer.
Displays the contents of all fields
within a protocol message.

5. What is Wireshark?
• Features
• Deep inspection of thousands of protocols
• Live capture and offline analysis
• Standard three-pane packet browser
• Captured network data can be browsed via a GUI, or via
the TTY-mode TShark utility
• The most powerful display filters in the industry
• Coloring rules can be applied to the packet list for quick,
intuitive analysis
• Output can be exported to XML, PostScript®, CSV, or
plain text

6. What is Wireshark?
• What we can:
• Capture network traffic
• Decode packet protocols using dissectors
• Define filters – capture and display
• Watch smart statistics
• Analyze problems
• Interactively browse that traffic
• Some examples people use Wireshark for:
• Network administrators: troubleshoot network problems
• Network security engineers: examine security problems
• Developers: debug protocol implementations
• People: learn network protocol internals

7. Interface
Packet
List
Packet
Details
Packet
Bytes

8. Interface (newer version)

9. Capturing Packets

10. Capturing Packets
Buffer size – in order not
to fill your laptop disk
Capture all packets on the
network
Capture filter
Capture in
multiple files
When to
automatically
stop the
capture
Display
options
Name
resolution
options

11. Capturing Packets (newer version)
New interface
Version 2.6

12. Analyzing Packets (layers 1 & 2)

13. Analyzing Packets (layer 3)
• IP Packet Example

14. Analyzing Packets (layer 4)
• TCP Packet Example

15. Analyzing Packets (TCP handshake)
• TCP 3-way Handshake

16. Analyzing Packets (Flow Graph)

17. Analyzing Packets (Graph Analysis)
• Flow Graph

18. Analyzing Packets (TCP Stream)
• Filtering Specific TCP Stream

19. Analyzing Packets (number of packets)
• Filtering Specific TCP Stream

20. Filtering Packets
• Applying Filter when Capturing Packets
Capture  Interfaces  Options:

21. Filtering Packets
 Applying Filter when Analyzing Packets

22. Filtering Packets
• Examples:
• Capture only traffic to or from IP address 172.18.5.4
• ip.addr == 172.18.5.4
• Capture traffic to or from a range of IP addresses
• ip.addr == 10.153.84.0/24
• ip.addr >= 10.153.84.74 || ip.addr <= 10.153.84.174
• Capture traffic from a range of IP addresses
• ip.src >= 10.153.84.74 || ip.src <= 10.153.84.174
• Capture traffic to a range of IP addresses
• ip.dst >= 10.153.84.74 || ip.dst <= 10.153.84.174
• Capture only DNS (port 53) traffic
• dns
• udp.dstport == 53

23. Filtering Packets
• Examples:
• Capture except all ARP and DNS traffic
• not udp.port == 53 and not arp
• Show only SMTP (port 25) and ICMP traffic
• tcp.port == 25 or icmp
• Capture non-HTTP and non-SMTP traffic on your server
• http.host == "www.example.com" and not (tcp.port
== 80 or tcp.port == 25)
• Capture only IP traffic
(the shortest filter, but sometimes very useful to get rid of lower
layer protocols like ARP)
• ip

24. Saving and Manipulating Packets
• Save only displayed packets

25. Saving and Manipulating Packets
• Export to CSV file

26. Packet Statistics (protocol hierarchy)

27. Packet Statistics (conversation)

28. Packet Statistics (IO graph)

29. Packet Statistics (TCP Stream Graph)
Show different visual representations of the TCP
streams in a capture.

30. References
• Wireshark Website
• http://www.wireshark.org
• Wireshark Documentation
• http://www.wireshark.org/docs/
• Wireshark Wiki
• http://wiki.wireshark.org
• Network analysis Using Wireshark Cookbook
• http://www.amazon.com/Network-Analysis-Using-
Wireshark-Cookbook/dp/1849517649

31. Lab activity 1: Using Wireshark
• Step 1: launch Wireshark
• Step 2: capture some traffic (ping and http requests)
• Using Wireshark answer the following questions:
• What is your MAC address?
• What is the protocol/port number of ping messages?
• What is the protocol/port number used to know the IP address of a
server/website?
• How many bytes in the ping message?
• Step 3: save the captured packets
• Step 4: Working with captured packets
1) Show only DNS and ICMP related traffic
2) Show all packets in a specific TCP session
3) List all endpoints within the captured traffic
4) List of the top talkers as well as who is talking to whom