Brief Contents. Acknowledgments... xv. Introduction...xvii. Chapter 1: Packet Analysis and Network Basics Chapter 2: Tapping into the Wire...

Transcription

1 Brief Contents Acknowledgments... xv Introduction...xvii Chapter 1: Packet Analysis and Network Basics... 1 Chapter 2: Tapping into the Wire Chapter 3: Introduction to Wireshark Chapter 4: Working with Captured Packets Chapter 5: Advanced Wireshark Features Chapter 6: Packet Analysis on the Command Line Chapter 7: Network Layer Protocols Chapter 8: Transport Layer Protocols Chapter 9: Common Upper-Layer Protocols Chapter 10: Basic Real-World Scenarios Chapter 11: Fighting a Slow Network Chapter 12: Packet Analysis for Security Chapter 13: Wireless Packet Analysis Appendix A: Further Reading Appendix B: Navigating Packets Index

2

3 Acknowledgments xv Introduction xvii Why This Book?.... xviii Concepts and Approach... xviii How to Use This Book.... xx About the Sample Capture Files... xx The Rural Technology Fund... xxi Contacting Me.... xxi 1 Packet Analysis and Network Basics 1 Packet Analysis and Packet Sniffers... 2 Evaluating a Packet Sniffer... 2 How Packet Sniffers Work... 3 How Computers Communicate Protocols... 4 The Seven-Layer OSI Model... 5 Network Hardware Traffic Classifications Broadcast Traffic Multicast Traffic Unicast Traffic Final Thoughts Tapping into the Wire 17 Living Promiscuously Sniffing Around Hubs Sniffing in a Switched Environment Port Mirroring Hubbing Out Using a Tap ARP Cache Poisoning Sniffing in a Routed Environment Sniffer Placement in Practice Introduction to Wireshark 37 A Brief History of Wireshark The Benefits of Wireshark... 38

4 Installing Wireshark Installing on Windows Systems Installing on Linux Systems Installing on OS X Systems Wireshark Fundamentals Your First Packet Capture Wireshark s Main Window Wireshark Preferences Packet Color Coding Configuration Files Configuration Profiles Working with Captured Packets 53 Working with Capture Files Saving and Exporting Capture Files Merging Capture Files Working with Packets Finding Packets Marking Packets Printing Packets Setting Time Display Formats and References Time Display Formats Packet Time Referencing Time Shifting Setting Capture Options Input Tab Output Tab Options Tab Using Filters Capture Filters Display Filters Saving Filters Adding Display Filters to a Toolbar Advanced Wireshark Features 77 Endpoints and Network Conversations Viewing Endpoint Statistics Viewing Network Conversations Identifying Top Talkers with Endpoints and Conversations Protocol Hierarchy Statistics Name Resolution Enabling Name Resolution Potential Drawbacks to Name Resolution Using a Custom hosts File Manually Initiated Name Resolution Protocol Dissection Changing the Dissector Viewing Dissector Source Code x

5 Following Streams Following SSL Streams Packet Lengths Graphing Viewing IO Graphs Round-Trip Time Graphing Flow Graphing Expert Information Packet Analysis on the Command Line 103 Installing TShark Installing tcpdump Capturing and Saving Packets Manipulating Output Name Resolution Applying Filters Time Display Formats in TShark Summary Statistics in TShark Comparing TShark and tcpdump Network Layer Protocols 119 Address Resolution Protocol (ARP) ARP Packet Structure Packet 1: ARP Request Packet 2: ARP Response Gratuitous ARP Internet Protocol (IP) Internet Protocol Version 4 (IPv4) Internet Protocol Version 6 (IPv6) Internet Control Message Protocol (ICMP) ICMP Packet Structure ICMP Types and Messages Echo Requests and Responses traceroute ICMP Version 6 (ICMPv6) Transport Layer Protocols 151 Transmission Control Protocol (TCP) TCP Packet Structure TCP Ports The TCP Three-Way Handshake TCP Teardown TCP Resets User Datagram Protocol (UDP) UDP Packet Structure xi

6 9 Common Upper-Layer Protocols 163 Dynamic Host Configuration Protocol (DHCP) DHCP Packet Structure The DHCP Initialization Process DHCP In-Lease Renewal DHCP Options and Message Types DHCP Version 6 (DHCPv6) Domain Name System (DNS) DNS Packet Structure A Simple DNS Query DNS Question Types DNS Recursion DNS Zone Transfers Hypertext Transfer Protocol (HTTP) Browsing with HTTP Posting Data with HTTP Simple Mail Transfer Protocol (SMTP) Sending and Receiving Tracking an Message Sending Attachments via SMTP Final Thoughts Basic Real-World Scenarios 199 Missing Web Content Tapping into the Wire Analysis Lessons Learned Unresponsive Weather Service Tapping into the Wire Analysis Lessons Learned No Internet Access Gateway Configuration Problems Unwanted Redirection Upstream Problems Inconsistent Printer Tapping into the Wire Analysis Lessons Learned No Branch Office Connectivity Tapping into the Wire Analysis Lessons Learned Software Data Corruption Tapping into the Wire Analysis Lessons Learned Final Thoughts xii

7 11 Fighting a Slow Network 231 TCP Error-Recovery Features TCP Retransmissions TCP Duplicate Acknowledgments and Fast Retransmissions TCP Flow Control Adjusting the Window Size Halting Data Flow with a Zero Window Notification The TCP Sliding Window in Practice Learning from TCP Error-Control and Flow-Control Packets Locating the Source of High Latency Normal Communications Slow Communications: Wire Latency Slow Communications: Client Latency Slow Communications: Server Latency Latency Locating Framework Network Baselining Site Baseline Host Baseline Application Baseline Additional Notes on Baselines Final Thoughts Packet Analysis for Security 257 Reconnaissance SYN Scan Operating System Fingerprinting Traffic Manipulation ARP Cache Poisoning Session Hijacking Malware Operation Aurora Remote-Access Trojan Exploit Kit and Ransomware Final Thoughts Wireless Packet Analysis 295 Physical Considerations Sniffing One Channel at a Time Wireless Signal Interference Detecting and Analyzing Signal Interference Wireless Card Modes Sniffing Wirelessly in Windows Configuring AirPcap Capturing Traffic with AirPcap Sniffing Wirelessly in Linux Packet Structure xiii

8 Adding Wireless-Specific Columns to the Packet List Pane Wireless-Specific Filters Filtering Traffic for a Specific BSS ID Filtering Specific Wireless Packet Types Filtering a Specific Frequency Saving a Wireless Profile Wireless Security Successful WEP Authentication Failed WEP Authentication Successful WPA Authentication Failed WPA Authentication Final Thoughts A Further Reading 317 Packet Analysis Tools CloudShark WireEdit Cain & Abel Scapy TraceWrangler Tcpreplay NetworkMiner CapTipper ngrep libpcap Npcap hping Python Packet Analysis Resources Wireshark s Home Page Practical Packet Analysis Online Course SANS s Security Intrusion Detection In-Depth Course Chris Sanders s Blog Brad Duncan s Malware Traffic Analysis IANA s Website W. Richard Stevens s TCP/IP Illustrated Series The TCP/IP Guide B Navigating Packets 325 Packet Representation Using Packet Diagrams Navigating a Mystery Packet Final Thoughts Index 333 xiv