Category Archives: wireshark

Wireshark

A new book into my pariticular library.
Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide

I was following to close Laura Chappell and after a hard day in the office I decided to buy this book.
I was feed up to see some of the options in a capture and using Wireshark at 10 or 20 % of the capacity.
I said to mylef, this is not the right path to understand and to analyze a network.
It is time to chage and to try to understand a bit more this fantastic tool.

Who knows is this is my new certification challenge…. Let´s see. At the moment I started with the chapter in which is explaining all the options in the program.

If you are thinking in buy the book you have some options:

http://www.wiresharkbook.com/
http://www.amazon.com/

tcpdump

tcpdump

tcpdump [ -AdDefIKlLnNOpqRStuUvxX ] [ -B buffer_size ] [ -c count ]
[ -C file_size ] [ -G rotate_seconds ] [ -F file ]
[ -i interface ] [ -m module ] [ -M secret ]
[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ]
[ -E spi@ipaddr algo:secret,… ]
[ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
[ expression ]

Command Line Options
-A Print frame payload in ASCII
-c <count> Exit after capturing count packets
-D List available interfaces
-e Print link-level headers
-F <file> Use file as the filter expression
-G <n> Rotate the dump file every n seconds
-i <iface> Specifies the capture interface
-K Don’t verify TCP checksums
-L List data link types for the interface
-n Don’t convert addresses to names
-p Don’t capture in promiscuous mode
-q Quick output
-r <file> Read packets from file
-s <len> Capture up to len bytes per packet
-S Print absolute TCP sequence numbers
-t Don’t print timestamps
-v[v[v]] Print more verbose output
-w <file> Write captured packets to file
-x Print frame payload in hex
-X Print frame payload in hex and ASCII
-y <type> Specify the data link type
-Z <user> Drop privileges from root to user

EXAMPLES

To print all packets arriving at or departing from sundown:

tcpdump host sundown

To print traffic between helios and either hot or ace:

tcpdump host helios and \( hot or ace \)

To print all IP packets between ace and any host except helios:

tcpdump ip host ace and not helios

To print all traffic between local hosts and hosts at Berkeley:

tcpdump net ucb-ether

To print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell from (mis-)interpreting the parentheses):

tcpdump 'gateway snup and (port ftp or ftp-data)'

To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net).

tcpdump ip and not net localnet

To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.

tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets. (IPv6 is left as an exercise for the reader.)

tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

To print IP packets longer than 576 bytes sent through gateway snup:

tcpdump 'gateway snup and ip[2:2] > 576'

To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:

tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'

To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):

tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'

Videos

Surfing the internet I have founded a few interesting videos.


video

Introduction to Wireshark


video
Custom Wireshark Shortcuts


video
How to solve a network mistery


video
The Case of the Missing Download


video
The Case of the Slow Network


video
The Case of the Missing DNS Load Balancer


video
The case of the slow iSCSI SAN

You can find all this videos in http://www.wireshark.org/

3 way handshake

TCP 3 way hadshake is a method to establish and  brake down TCP socket connections.This is a connection oriented protocol. That’s why TCP uses specific control parameters as control bits:

* URG. Urgent pointer field significant

* ACK. Acknowledgement filed significant

* PSH. Push Function

* RST. Reset connection

* SYN. Synchronize sequence numbers

* FIN. No more data from sender

The protocol operation is as follow:
I can suppose that we have got a client host and server host. Client wants to stablish a comunication with the server.
Server is listen and waiting for a connection request from any remote client. This action is called passive open.

1 – Client send a connection request.

SYN ————>

2 – Server has received a SYN from the client and it send back an aknowledgment.

<———— SYN-ACK

3 – Client sends an ACK back to the server.

ACK ————>

Connection is stablished till the client sends a FIN to end.

This is a capture  taken with Wireshark

Checking frame by frame, you can see each flag: