Analysis with Wireshark

Views: 18

TShark VS. Wireshark (Terminal vs. GUI)

TShark is a purpose-built terminal tool based on Wireshark. TShark shares many of the same features that are included in Wireshark and even shares syntax and options. TShark is perfect for use on machines with little or no desktop environment and can easily pass the capture information it receives to another tool via the command line. Wireshark is the feature-rich GUI option for traffic capture and analysis. If we wish to have the full-featured experience and work from a machine with a desktop environment, the Wireshark GUI is the way to go.

Basic TShark Switches

TShark Basic Usage

tshark -h

which tshark

tshark -D

## Capturing
tshark -i 1 -w /tmp/test.pcap

## Selecting an Interface & Writing to a File
sudo tshark -i eth0 -w /tmp/test.pcap

## Applying Filters
 sudo tshark -i eth0 -f "host 172.16.146.2"

Termshark

Termshark is a Text-based User Interface (TUI) application that provides the user with a Wireshark-like interface right in your terminal window.

To start Termshark, issue the same strings, much like TShark or tcpdump. We can specify an interface to capture on, filters, and other settings from the terminal. The Termshark window will not open until it senses traffic in its capture filter. So give it a second if nothing happens.

Wireshark

ORANGE: Summary line of each packet, BLUE: Packet Details window with each packet dissected into different encapsulation layers for inspection and GREEN: Packet Bytes windos with packet contents in ASCII or hex output

Capture Filters

Capture Filters- are entered before the capture is started. These use BPF syntax like host 214.15.2.30 much in the same fashion as TCPDump.

Display Filters

Display Filters- are used while the capture is running and after the capture has stopped. Display filters are proprietary to Wireshark, which offers many different options for almost any protocol.

Common and helpful display filters

Wireshark Advanced Usage

Plugins

The Statistics and Analyze Tabs

The Statistics and Analyze tabs can provide us with great insight into the data we are examining. From these points, we can utilize many of the baked-in plugins Wireshark has to offer.

Analyze Tab

From the Analyze tab, we can utilize plugins that allow us to do things such as following TCP streams, filter on conversation types, prepare new packet filters and examine the expert info Wireshark generates about the traffic. Below are a few examples of how to use these plugins.

Following TCP Streams

Wireshark can stitch TCP packets back together to recreate the entire stream in a readable format. This ability also allows us to pull data (images, files, etc.) out of the capture. This works for almost any protocol that utilizes TCP as a transport mechanism.

Alternatively, we can utilize the filter tcp.stream eq # to find and track conversations captured in the pcap file.

Filter For A Specific TCP Stream

Extracting Data and Files From a Capture

Wireshark can recover many different types of data from streams. It requires you to have captured the entire conversation. Otherwise, this ability will fail to put an incomplete datagram back together. 

Display Filters Reference

Complete List: https://www.wireshark.org/docs/dfref/

FTP display filters

Miscellaneous

ARP Spoofing & Abnormality Detection

## Display Filter
arp.opcode

Opcode = = 1: This represents all types of ARP Requests
Opcode = = 2: This signifies all types of ARP Replies

To sift through more duplicate records, we can utilize the subsequent Wireshark filter.

arp.duplicate-address-detected && arp.opcode == 2

Identifying The Original IP Addresses

(arp.opcode) && ((eth.src == 08:00:27:53:0c:ba) || (eth.dst == 08:00:27:53:0c:ba))

In this case, we might instantly note that the MAC address 08:00:27:53:0c:ba was initially linked to the IP address 192.168.10.5, but this was recently switched to 192.168.10.4. This transition is indicative of a deliberate attempt at ARP spoofing or cache poisoning.

Additionally, examining the traffic from these MAC addresses with the following Wireshark filter can prove insightful:

eth.addr == 50:eb:f6:ec:0e:7f or eth.addr == 08:00:27:53:0c:ba

Right off the bat, we might notice some inconsistencies with TCP connections. If TCP connections are consistently dropping, it’s an indication that the attacker is not forwarding traffic between the victim and the router.

If the attacker is, in fact, forwarding the traffic and is operating as a man-in-the-middle, we might observe identical or nearly symmetrical transmissions from the victim to the attacker and from the attacker to the router.