Wireshark Drinking straight from the network hose Wireshark - PDF document

Wireshark Drinking straight from the network hose

Wireshark Drinking straight from the network hose Md. Abdul Awal TEIN Application Workshop 2017 BdREN University of Dhaka awal@bdren.net.bd December 11, 2017 These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license. https://creativecommons.org/licenses/by-nc/4.0/

Agenda • Wireshark Intro • Monitoring port using Wireshark • Demo/Lab • Discussion awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 2

Motivation for Network Monitoring • Essential for Network Management • Router and Firewall policy • Detecting abnormal/error in networking • Access control • Security Management • Detecting abnormal traffic • Traffic log for future forensic analysis awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 3

What is Wireshark? • Packet sniffer/protocol analyzer • Open Source Network Tool • Latest version of the ethereal tool awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 4

Installation • Windows/MacOS Download: https://www.wireshark.org/#download • Linux: CentOS – yum install wireshark Ubuntu – apt-get install wireshark Red Hat – rpm –iv wireshark*rpm awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 5

Wireshark Interface Command Menu Display Filter Menu Captured Packet List Selected Packet’s Info Packet’s Content in ASCII and Hex Format Status Bar awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 6

Where do I put the Wireshark?

Hub awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 8

Switch awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 9

Switch with SPAN Port awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 10

Tap awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 11

Lab 1 • Open Wireshark • Select your LAN/WLAN interface to capture traffic • Select to stop Wireshark after 5MB • Run Capture • Open your browser and log on to tein.asia • Ping tein.asia to identify the IP address • Find the IP from the captured packets awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 12

Display Filter (Post Filter) awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 13

Display Filter Examples • ip.src == 10.1.11.24 • ip.addr == 192.168.1.10 && ip.addr==192.168.1.20 • tcp.dstport== 80 • tcp.port == 80 || tcp.port == 3389 • !(ip.addr == 192.168.1.10 && ip.addr == 192.168.1.20) • (ip.addr == 192.168.1.10 && ip.addr == 192.168.1.20) && (tcp.port == 445 || tcp.port == 139) • (ip.addr == 192.168.1.10 && ip.addr == 192.168.1.20) && (udp.port == 67 || udp.port == 68) awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 14

Statistics>Protocol Hierarchy awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 15

Export HTTP Object awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 16

Analyze>Follow>TCP Stream RED: Stuff you sent BLUE: Stuff you get awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 17

Statistics>Conversations awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 18

Statistics>Flow Graph awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 19

Statistics>Packet Lengths awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 20

Statistics>TCP Stream Graphs>RTT awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 21

Lab 2 • Open GNS3 and prepare the following lab • Configure interfaces with IP addresses • Configure VTY interface for telnet awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 22

Example: R2 interface fa0/0 no shutdown ip address 10.10.10.2 255.255.255.252 ! line vty 0 4 password abc123 login awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 23

Open Wireshark awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 24

Ping R2 from R1 ping 10.10.10.2 repeat 50 awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 25

Telnet to R2 from R1 telnet 10.10.10.2 awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 26

Analyze>Follow>TCP Stream awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 27

Homework Do it for SSH awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 28

Improve Wireshark Performance • Don’t use capture filters • Increase your read buffer size • Get a faster computer • Use a TAP • Don’t resolve names awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 29

Questions? awal@bdren.net.bd TEIN Application Workshop 2017, University of Dhaka 30