This document provides an introduction to the packet analysis tool Wireshark. It introduces key people involved in Wireshark including creator Gerald Combs and trainer Laura Chappell. It reviews common network protocols like Ethernet, IP, TCP and TCP/IP. It provides an overview of how to use Wireshark including capturing packets, filtering displays, saving files and more. The document concludes with resources for learning more about Wireshark and guides for certification.

1. An Introduction to Protocol Analysis

2. INTRODUCTIONS

3. Gerald Combs
 Author
 Founder
 Developer
 Community Leader

4. Cace Technologies
 Where Gerald Works (for now)
 Home of AirPcap
 For wireless captures of 802.11 frames
 TurboCap
 Wireshark Appliances
 Pilot Reporting Software

5. PILOT

6. Laura Chappell
 Where to begin
 Is an independent
 Runs
 Wireshark University
 Chappell University
 Heads up Wireshark
Certification

7. Wireshark University
 Training Materials
 Videos
 Captures
 Books
 CD/DVD

8. Other Tools
 T Shark  TCPDump
 Included with wireshark  Native to *nix
 Netmonitor  Windows version
 Capsa  Snoop
 Cain  Sun Microsystems
 Windump  Ettercap
 Dsniff
 Ngrep

9. OVERVIEW

10. Purpose
 Troubleshooting
 Slow Networks
 Application Problems
 DNS Issues
 Web Servers
 DHCP Issues

11. Review of OSI
 Layer 7 Application (Net Process to App)
 Layer 6 Presentation (Data Rep. & Encrypt)
 Layer 5 Session (Interhost Comm)
 Layer 4 Transport (Delivery Protocol)
 Layer 3 Network (Logical Addressing)
 Layer 2 Data Link (Physical Addressing)
• MAC
• LLC
 Layer 1 Physical (Media, signal & Bin)

12. Review of OSI
 Layer 8 Politics & Money

13. Review of Ethernet

14. Ethernet Frame Structure

15. Review of IP

16. IP Packet Structure

17. Review of TCP

18. TCP Segment Structure

19. Review of TCP/IP
 TCP  IP
 Layer 4 Transport  Layer 3 Logical
 RES/NONCE/CWR/ECHO Addressing Protocol
 URG/ACK/PSH/RST/SYN/ (10.1.0.22/24)
FIN
 Connection Oriented
 UDP
 Layer 4 Transport
Protocol
 Connectionless

20. TCP Flags
• Special Flags (first one reserved)
• NS = Nonce Sum
• CWR = Congestion Window Reduced
• ECE = ECN-Echo
• URG = Urgent
• ACK = Acknowledgement
• PSH = Push
• RST = Reset
• SYN = Synchronize
• FIN = Finish

21. See Appendix A

23. Basic Network Applications
 FTP - TCP  SIP – TCP/UDP
 Ports 20 & 21  Port 5060
 Telnet - TCP  SQL - TCP
 Port 23  Port 1433
 SMTP - TCP  RDP - TCP
 Port 25  Port 3389
 DNS - UDP  PPTP - TCP
 Port 53  1723 & 1725
 HTTP - TCP  Syslog – UDP
 Port 80  Port 514

24. TCP HADNSHAKE

25. DATA TRANSFER

26. SESSION CLOSURE

27. LAB/BREAK

28. A Guided Tour

29. Profiles

30. Preferences

31. DIRECTORY STRUCTURE

32. Personal Settings
 C:users<username>AppDataRoamingWireshark
profiles
 Profiles
 cfilters
 preferences

33. System Settings
 C:program fileswireshark
 Dfilters – display filters
 Dumpcap - program
 Editcap – edit .pcap files
 Mergecap – merge .pcap files
 Rawshark – capture in “raw” format
 Text2pcap – conversion tool
 Tshark – cli version of wireshark
 Colorfilters (don’t touch!)

34. Ring Buffers
 What are they  Configuring
 Where are they stored  Single/multiple
 Why are they useful  What size
 How often
 How many
 Stopping

35. Selecting an Interface
 Preferences  Manually

36. Saving Files
 Where?
 How big?
 How many?
 What format?
 Speed to disk

37. Placement
 Hubbing Out -> Easy but loss of data
 Port Spanning -> Good on less busy net
 In Line Taps -> Best but pricey

38. CAPTURES
Get as close as possible!

39. Captures
 Where to store them
 How much space do they
take up
 How to store them

40. Display Filters
 Not my MAC

41. Capture Filters
 Not my MAC

42. Colorizing
 Built in scheme
 Change on the fly

43. LAB 1

44. LAB 2

45. LAB 3

46. LAB 4

47. LAB 5

48. Statistics and Reporting

49.  Statistics  Advanced Statistics
 Conversations  Conversation lists
 Endpoints
 IP Addresses
 IP Endpoints
 IP Protocol Types
 UDP Multicast Streams
WLAN Traffic

50. RESOURCES
 www.wireshark.org  Wireshark
 www.cacetech.com  Wireshark Certification
 www.chappellseminars.c Guide
om  Wireshark Certification
 www.wiresharkuniversity Exm Prep Guide
.com

51. STAY SECURE!