Knowledge Base

What is Wireshark and What Does It Do?

Wireshark is the world's most popular and powerful open-source network protocol analyzer, used to analyze network traffic and troubleshoot problems. Basically, it captures all data packets passing through your network card and displays them in a human-readable format. This allows you to examine communication on your network in detail, identify potential security vulnerabilities, identify performance issues, and understand how applications work.

• Troubleshooting Network Problems: In cases such as network connection problems, slow performance, and packet loss, you can find the source of the problem by analyzing with Wireshark.
• Security Analysis: By detecting suspicious network traffic, you can uncover unauthorized access attempts or communications from malicious software.
• Application Development: By examining the behavior of applications on the network, you can optimize performance and fix errors.
• Protocol Learning: Wireshark is an ideal tool for learning how different network protocols work in practice.

How Wireshark Works? Packet Capture and Analysis Process

Wireshark's working principle is quite simple: it captures all packets passing through your network card and allows you to analyze them. This process generally consists of the following steps:

1. Packet Capture: Wireshark puts your network card into a mode called "promiscuous mode". In this mode, your network card listens to all packets on the network, not just the packets sent to it.
2. Packet Filtering (Optional): You can use filters to reduce the number of captured packets and make analysis easier. For example, you can filter packets coming from a specific IP address or communicating with a specific protocol.
3. Packet Analysis: Wireshark parses the captured packets according to their protocols and displays the contents of each packet in detail. In this way, you can examine which protocol the packets are communicating with, their source and destination addresses, data content, and other important information.

Example: To analyze the HTTP traffic generated when accessing a website, you can use the `http` filter. This filter will only show packets related to the HTTP protocol.

# Filtering HTTP traffic
http

Visual Description: (Textual Description) Imagine a schema. The schema shows an HTTP request leaving the user's computer being captured and analyzed by Wireshark. The schema visually represents the packet capture, filtering, and analysis steps.

Wireshark Installation and Basic Configuration

Installing Wireshark is quite simple. You can perform the installation by following the steps below:

1. Download Wireshark: Download the version of Wireshark that is appropriate for your operating system from the official Wireshark website (www.wireshark.org).
2. Start the Installation: Run the installation file you downloaded and follow the installation wizard.
3. Install Npcap: During the Wireshark installation, you will be prompted to install a packet capture driver called Npcap (Windows Packet Capture). Installing Npcap is necessary for Wireshark to be able to capture packets from your network card.
4. Select the Network Interface: After the installation is complete, start Wireshark and select the network interface you want to capture packets from.

Important Note: When using Wireshark on Windows, you may need to have administrator privileges for the packet capture process.

Basic Configuration:

• Interface Selection: When you open Wireshark, you will see a list of network interfaces that you can capture on. Make sure you select the correct interface (e.g., Ethernet, Wi-Fi).
• Filtering: You may capture a lot of traffic initially. You can use filters to view only the traffic you are interested in.
• Profile Creation: You can create different profiles for different analysis scenarios. These profiles allow you to save filters, columns, and other settings.

Wireshark Filters: Capture and Display Filters

Wireshark filters are powerful tools used to reduce the number of captured packets and facilitate analysis. There are two types of filters:

• Capture Filters: Filters applied during the packet capture process. These filters ensure that only packets that meet certain criteria are captured. Capture filters are important for improving performance when analyzing large amounts of traffic.
• Display Filters: Filters applied to captured packets. These filters ensure that only packets that meet certain criteria are displayed. Display filters are useful for searching through captured data and identifying specific problems.

Capture Filter Examples:

• `host 192.168.1.100`: Captures only packets with the IP address 192.168.1.100.
• `port 80`: Captures only packets using port 80 (HTTP traffic).
• `tcp`: Captures only packets using the TCP protocol.

Display Filter Examples:

• `ip.src == 192.168.1.100`: Displays packets with the source IP address 192.168.1.100.
• `tcp.port == 443`: Displays packets with TCP port 443 (HTTPS traffic).
• `http.request.method == "GET"`: Displays HTTP GET requests.

Important Note: Capture filters consume fewer resources and are more effective when analyzing large amounts of traffic. Display filters, on the other hand, are more suitable for performing detailed searches within the captured data.

# Capture filter to capture packets coming from a specific IP address and using port 80
host 192.168.1.100 and port 80

# Display filter to display HTTP GET requests
http.request.method == "GET"

Troubleshooting Common Network Issues with Wireshark

Wireshark is a powerful tool for troubleshooting network issues. Here are some common network problems you can solve with Wireshark:

• Slow Network Performance: By analyzing network traffic with Wireshark, you can identify the factors causing slow performance (e.g., high latency, packet loss, excessive bandwidth usage).
• Connectivity Issues: With Wireshark, you can determine the cause of connectivity problems (e.g., DNS issues, misconfigured IP addresses, firewall blocks).
• Security Vulnerabilities: By analyzing suspicious network traffic with Wireshark, you can detect unauthorized access attempts, malware communications, or data leaks.
• Application Performance Issues: By examining the behavior of applications on the network with Wireshark, you can fix errors or optimization deficiencies that cause performance problems.

Case Study: A company's website was running slowly. Analysis with Wireshark revealed a large number of SYN requests to the web server. This was a sign of a DDoS attack. Security measures were taken to prevent the attack and the website's performance improved.

Step-by-Step Process: Troubleshooting Slow Network Performance

1. Packet Capture: Start Wireshark and begin capturing network traffic.
2. Filtering: Use appropriate filters to filter network traffic (e.g., `tcp.analysis.flags`, `tcp.time_delta`).
3. Analysis: Analyze the captured packets and identify the factors causing slow performance (e.g., high latency, packet loss).
4. Solution: After identifying the source of the problem, apply appropriate solutions (e.g., restart network devices, update firewall rules, optimize applications).

Security Analysis with Wireshark: Detecting Suspicious Traffic

Wireshark can be used to detect suspicious traffic on your network and uncover potential security vulnerabilities. Here are some security analyses you can do with Wireshark:

• Unauthorized Access Attempts: By analyzing network traffic with Wireshark, you can detect unauthorized access attempts (e.g., brute-force attacks, port scans).
• Malware Communications: With Wireshark, you can detect malware communications over the network (e.g., connections to command and control servers, data leaks).
• Data Leaks: You can use Wireshark to check if sensitive data is being sent unencrypted over the network.
• Suspicious Protocol Usage: With Wireshark, you can detect the use of rarely used or unexpected protocols on your network.

Example: It was detected that a computer was constantly sending data to an unknown IP address. Analysis with Wireshark revealed that this connection was unencrypted and contained sensitive data. It was understood that the computer was infected with malware, and the necessary cleaning procedures were performed.

# Filtering connections to a specific IP address
ip.dst == 192.168.1.200

# Filtering unencrypted HTTP traffic
http.request

Table: Types of Security Analysis That Can Be Performed with Wireshark

Wireshark's Advanced Features and Tips

Wireshark has a number of advanced features that allow you to perform more complex analyses beyond basic analysis capabilities. Here are some important features and tips:

• Protocol Dissectors: Wireshark supports hundreds of different network protocols and includes specific dissectors for each protocol. These dissectors allow you to analyze the content of packets in more detail.
• Graphical Analysis Tools: Wireshark offers various graphical tools that allow you to visually analyze network traffic. These tools help you identify trends, anomalies, and other important information more easily.
• Lua Scripting: Wireshark supports the Lua scripting language. This allows you to create your own custom dissectors, filters, and analysis tools.
• Command Line Tools: Wireshark offers various tools that you can use from the command line (e.g., `tshark`). These tools are useful for performing automated analyses or integrating Wireshark with other tools.

Tips:

• Learn Filters: Wireshark filters are critical for speeding up your analysis and keeping you focused. Learn frequently used filters and create your own custom filters.
• Understand Protocols: Understanding how the protocols you are analyzing work will help you solve problems faster.
• Update Regularly: By updating Wireshark regularly, you can protect yourself against the latest security vulnerabilities and take advantage of new features.
• Practice: The more you use Wireshark, the more skilled you become. By practicing on different scenarios, you can unlock the full potential of Wireshark.

Table: Wireshark Command Line Tools (tshark)

Example Lua Script:

-- Lua script that calculates the length of an HTTP request
local http_proto = Proto("http_length", "HTTP Length Calculator")

local length_field = ProtoField.uint32("http_length.length", "HTTP Length", base.DEC)

http_proto.fields = {length_field}

function http_proto.dissector(tvbuf, pktinfo, tree)
  local length = tvbuf:len()
  local subtree = tree:add(http_proto, tvbuf:range(0, length), "HTTP Length: " .. length)
  subtree:add(length_field, tvbuf:range(0, length), length)
end

register_postdissector(http_proto)

This script calculates the length of each HTTP request and displays it in the Wireshark interface. Such scripts can be used to extend the capabilities of Wireshark.