Wireshark Network Traffic Analysis Basics
Explore the fundamentals of Wireshark for capturing and analyzing network data. Learn about its powerful capabilities, basic functions, installation on various operating systems, and device classification methods. Discover insights into IPv4, network structures, and key concepts in cybersecurity.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Attendance Form Cybersecurity UW - 10/27
Introduction to Wireshark Network Traffic Analysis
Why use Wireshark? Very powerful tool for capturing network data Very comprehensive Scriptable
Wireshark Basic Functions Basic Network Protocols Capturing Viewing PCAP Files Wireshark is very good at breaking down large sets of data being passed through a network. To find a specific packet of data, the user can search and filter the data and then analyze the packets they need. For example, the user took the captured data in the left picture and filtered to only see the DNS data in the right picture. Through Wireshark, users can packet sniff data going through the Network Interface Card on a device. This is very crucial for network monitoring. To begin capturing, select Capture and then select the interface of choice. Packet Capture (PCAP) is used to analyze networks. By using Wireshark, you can capture packets and then view these packets using NMAP s PCAP or NPCAP. You can view these packets by clicking on File and then Open.
Wireshark Installation Windows/Mac: https://www.wireshark.org/download.html Linux: check w/ your distro Ubuntu/Debian based distros: sudo apt install wireshark
Network: A group of interconnected devices
How to Classify devices IPv4 32 bit unsigned integer 0x0 - 0xFFFFFFFF Can be converted to human readable format x.x.x.x where (-1<x<256) 0xDEADBEEF -> 0xDE.0xAD.0xBE.0xEF -> 222.173.190.239 Older More standard MAC Address Media Access Control Address Unique identifier 00:00:00:00:00:00, but can vary
IPv4 Format is a.b.c.d where a,b,c,d are some number between 0-255 256 * 256 * 256 * 256
4,294,967,296 Around 4 billion
How many people are in the world?
There is not enough addresses
What is a Network Local Area Network (LAN) Small Scale Private Wide Area Network (WAN) The Internet
Protocol Definition: A pre-agreed upon format to send data Like a language Examples: HTTP/HTTPS SMTP SSH
Packets Small segments of data in a specific format
UDP Header Source: Wikipedia Given the UDP header c7 82 00 50 00 5d ?? ??, what is source port and destination port?
TCP Header Way more complicated
Analogy Length Everything else is the Header Destination Address Source Address Date shipped Etc
This is a very very high level overview with many parts abstracted for simplicity
Demo: Analyzing some HTTP traffic
