Wireshark Network Traffic Analysis Basics
Attendance Form
Cybersecurity UW - 10/27
Introduction to
Wireshark
Network Traffic Analysis
Why use Wireshark?
Very powerful tool for capturing network
data
Very comprehensive
Scriptable
Wireshark Basic Functions
Capturing
Through Wireshark, users can packet
sniff data going through the Network
Interface Card on a device. This is
very crucial for network monitoring.
To begin capturing, select “Capture”
and then select the interface of
choice.
Basic Network Protocols
Wireshark is very good at breaking down large
sets of data being passed through a network.
To find a specific packet of data, the user can
search and filter the data and then analyze the
packets they need. For example, the user took
the captured data in the left picture and
filtered to only see the DNS data in the right
picture.
Viewing PCAP Files
Packet Capture (PCAP) is used to
analyze networks. By using Wireshark,
you can capture packets and then
view these packets using NMAP’s
PCAP or NPCAP. You can view these
packets by clicking on “File” and then
“Open.”
Wireshark Installation
Windows/Mac:
https://www.wireshark.org/download.html
Linux:
check w/ your distro
Ubuntu/Debian based distros:
sudo apt install wireshark
Network: A group of
interconnected devices
How to Classify devices
IPv4
32 bit unsigned integer 0x0 - 0xFFFFFFFF
Can be converted to human readable format x.x.x.x where (-1<x<256)
0xDEADBEEF -> 0xDE.0xAD.0xBE.0xEF -> 222.173.190.239
“Older”
More standard
MAC Address
Media Access Control Address
Unique identifier
00:00:00:00:00:00, but can vary
SOME MATH
IPv4
Format is a.b.c.d where a,b,c,d are some number between 0-255
256 * 256 * 256 * 256
4,294,967,296
Around 4 billion
How many people are in
the world?
~8 billion
There is not enough
addresses
What is a Network
●
Local Area Network (LAN)
○
Small Scale
○
Private
●
Wide Area Network (WAN)
○
The Internet
Local Area Network
4 Main Points of A LAN
●
IP
○
A combination of numbers, and sometimes letters, to identify devices on a
network
●
Router
○
Forwards data between different computer networks, also the
gateway
●
Switch
○
Connects devices within a network
●
Subnet
○
Defines a range of IPs on a network
Wide Area Network
4 Point Worth Mentioning
●
Network address translation (NAT)
○
Changes internal ip address when goes out to internet
●
Firewall
○
Does not allow outside devices to talk directly to a device
●
Port forwarding
○
internal device has specific port that receives communications from
internet
●
Demilitarized Zone (DMZ)
○
Area created in LAN for requests from the outside for internal devices
Protocol
Definition: A pre-agreed upon format to send data
Like a language
Examples:
HTTP/HTTPS
SMTP
SSH
Packets
Small segments of
data in a specific
format
IP Header of a Packet
UDP Header
Source: Wikipedia
Given the UDP header
c7 82
00 50
00 5d ?? ??, what is source port and destination port?
51074
->
80
TCP Header
Way more complicated
Analogy
Analogy
Length
Everything else is the Header
●
Destination Address
●
Source Address
●
Date shipped
●
Etc
This is a very very
high level overview
with many parts
abstracted for
simplicity
Demo: Analyzing some
HTTP traffic
Demo: evilcorp.digital
Challenge 1
Explore the fundamentals of Wireshark for capturing and analyzing network data. Learn about its powerful capabilities, basic functions, installation on various operating systems, and device classification methods. Discover insights into IPv4, network structures, and key concepts in cybersecurity.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Attendance Form Cybersecurity UW - 10/27
Introduction to Wireshark Network Traffic Analysis
Why use Wireshark? Very powerful tool for capturing network data Very comprehensive Scriptable
Wireshark Basic Functions Basic Network Protocols Capturing Viewing PCAP Files Wireshark is very good at breaking down large sets of data being passed through a network. To find a specific packet of data, the user can search and filter the data and then analyze the packets they need. For example, the user took the captured data in the left picture and filtered to only see the DNS data in the right picture. Through Wireshark, users can packet sniff data going through the Network Interface Card on a device. This is very crucial for network monitoring. To begin capturing, select Capture and then select the interface of choice. Packet Capture (PCAP) is used to analyze networks. By using Wireshark, you can capture packets and then view these packets using NMAP s PCAP or NPCAP. You can view these packets by clicking on File and then Open.
Wireshark Installation Windows/Mac: https://www.wireshark.org/download.html Linux: check w/ your distro Ubuntu/Debian based distros: sudo apt install wireshark
Network: A group of interconnected devices
How to Classify devices IPv4 32 bit unsigned integer 0x0 - 0xFFFFFFFF Can be converted to human readable format x.x.x.x where (-1<x<256) 0xDEADBEEF -> 0xDE.0xAD.0xBE.0xEF -> 222.173.190.239 Older More standard MAC Address Media Access Control Address Unique identifier 00:00:00:00:00:00, but can vary
IPv4 Format is a.b.c.d where a,b,c,d are some number between 0-255 256 * 256 * 256 * 256
4,294,967,296 Around 4 billion
How many people are in the world?
There is not enough addresses
What is a Network Local Area Network (LAN) Small Scale Private Wide Area Network (WAN) The Internet
Protocol Definition: A pre-agreed upon format to send data Like a language Examples: HTTP/HTTPS SMTP SSH
Packets Small segments of data in a specific format
UDP Header Source: Wikipedia Given the UDP header c7 82 00 50 00 5d ?? ??, what is source port and destination port?
TCP Header Way more complicated
Analogy Length Everything else is the Header Destination Address Source Address Date shipped Etc
This is a very very high level overview with many parts abstracted for simplicity
Demo: Analyzing some HTTP traffic
