Wireshark Network Forensics

Content

• Page-1: Capture devices
• Page-2: Capturing packets
• Page-3: Viewing Entire Stream
• Page-4: Bird's eye view
• Page-5: Coloring rules
• Page-6: Packet diagram
• Page-7: Delta time
• What to look for ?
• Important Filters
• Example & Exercises

Page-1: Capture devices

• Open ==> Wireshark

  

1. Saved Wireshark Files:

   

   • After, successfully Capturing & Saving your file.
   • Your file will display Here Above.
   • If you don't have any saved file there will be no Open section in your first page, Like below image.

2. The Capture Filter Bar:**

   

   • you can start Filtering before Capturing packets

   • Feature	Capture Filters	Display Filters
     When it's applied	Before you start capturing.	During or after the capture.
     Syntax	BPF (Berkeley Packet Filter)	Wireshark Display Syntax
     Primary Purpose	Save disk space & memory.	Visually analyze and sort captured data.
     Effect on Data	Permanent. Unmatched packets are discarded.	Temporary. Unmatched packets are just hidden.
     Example Syntax	host 192.168.1.5 and port 80	ip.addr == 192.168.1.5 && tcp.port == 80

3. NICs (Network Interface Cards):

   

   • ? Which Network Interface Cards are picking up traffic ?

   • --> The one with graphs

   • you have to be Connected to the Networks with your Device, that you want to look at.

   • Generally, you are going to look at your Ethernet or Wifi.

   • Double click on, one of this to Open next page.

Back to Content

Page-2: Capturing packets

• Double-click ==> NICs / Wifi

  

• After clicking

  • When we double-click, Immediately wireshark starts capturing packets & We can let it go & Capture packets for as long as we like.
  • So, If you're troubleshooting a particular website or Something like that, You wonna to try & Acess that website now while it's capturing.

• & Then once you think you have enough data, Once enough time has gone by, You can click on Red Square Button up here at the top left.

• you can see at the very bottom of the screen here, It tells us that it captured 433 packets

• If we click the Red Square Button, it will stop capturing & Start Displaying.

  • no. of packets captured successfully = 100% - Dropped

1. What is a packet ?

• --> Each of the rows that you see on the screen here Is a "Packet" of information.
  • Whenever information is transferred over a network, It's transferred via packets.
  • That means that every time you load a webpage, Every time you upload or download something, Packets of information are being transferred between you computer & A web server.

2. Right-click Filtering

• you can do that from anywhere in Wireshark right-click / Apply as Filter

  

  • also on which column you right-click / Apply as Filter / Suggest a filter as per column on which you click

    

  • right-click(Single packet) == There's a lot of valuable options from there

3. Filtering HTTPs (secure) traffic

• How can we look at secure traffic ?

• --> by typing https inside Filter bar

  

  • Red line == Wrong, means incorrect filter.

  • We actually have to use TCP, but a specific port & that's usually port 80.

  • it can also be port like 8000, 8001 & 8002.

  • generally port 80 for HTTPs.

    

    • Green line == Correct, means correct filter.
    • this will show you all of the packets that where sent on TCP port 80, aka encrypted traffic.

  • When we start to look at the actual data within these packets, we can't read it because it's encrypted.

    • Now, if you had the encryption key, you can actually upload that in here to wireshark & you can decrypt it.

4. Buttons

• So we did this filter tcp.port==80 previously to show all the traffic on port 80.
• What we can do is instead of having to type that every time, we can go over here to the right side of the screen & click on the plus icon.
  

  • Now, it allows us to create a filter Button so instead of typing tcp.port==80 this, We can just click on this Button.

    

    • Label: HTTPs(you can name it anything)
    • Filter: tcp.port==80(automically, if some filter was already in filter bar)
    • Comment: keep it empty

  • Hit "ok" right below plus icon

    • Now, we have this nice HTTPs button near plus icon.
    • click HTTPs button == auto filled the filter( tcp.port==80 ).

5. Colors

• Notice on the right side of the screen(near scroll bar), We can see the coloring as well.

  • So these are things that Wireshark is highlighting.
  • It's an analysis toll.
  • So it's captures the information, Which a lot of different tools can do.
  • plus +
  • Wireshark runs it's own analysis on that information & that's where these colored lines come through.
  • This Red ones & Black ones, Wireshark is saying, "Hey, there might be something here."
  • It's not like, "Hey, this is guaranteed Malware.

• So, we can see we've got maybe some "Spurious Retransmission".

  • An unnecessary TCP packet retransmission occuring when a Sender transmits a segment again, even though the Receiver has already acknowledge (ACK) the orginal data.
  • This often happens at the beginning of a capture. You'll notice as the capture went on it kind of stop.

6. Filtering HTTP

• In your filter just type HTTP

  

  • You'll notice when it turns green, it means that it is an accepted equation filter.
  • If it's red , it's not going to work.

7. Viewing Packet Contents

   

   • We have got Ethernet, TCP, IPv4, & HTTP
   • Wireshark kind of highlights, things that you might find intresting.

Back to Content

Page-3: Viewing Entire Stream

• right-click on ==> Single-packet / Follow / HTTP Stream

  

• After clicking

  • Viewing insecure data
    1. if you were looking at a packet sent over an encrypted connection, you could'nt really be able to read anything.
    2. We have this Entire Web page.
    3. This is the web page I went to while Wireshark is capturing.
    4. It's here in wireshark now.
    5. I could put this into a HTML compiler, & it would print out the Web page.
  • This is How Phishing works.
  1. Somebody sends you a link that maybe looks like your Bank link or a Social media link.
  2. So you enter your username & password.
  3. That person who's phishing you now can go in here to wireshark if they're Tapped into the network.
  4. They can see your username & password that you entered right here in Wireshark.

Back to Content

Page-4: Bird's eye view

• Go inside ==> Statistics / Conversations

  

• We have some tabs up here, Ethernet . 1, IPv4 . 3, ... and so on, To go through the different protocols.

  

  • View of everything going on in wireshark. But, We actually use this screen to start filtering our packets.
  • Any time you're doing network analysis, It's a good idea to know some of the IP addresses on your network.
  • Settings / Network & internet / Wifi / "your Wifi name"

• Scroll down to IPv4 address = IP address of your PC

  \

  • If there's a particular device that you're trying to troubleshoot, It's a good to know maybe the Mac address of that device.
  • So I have my IP address ( 10.24.12.20 ) & I want to find where it's in this Address A

• right-click on your IP address/Apply as Filter/Selected/A <--> Any \

  • A is either sending or receiving from any IP address. So when I click on this

• you'll notice that a filter is now automatically put here in the top Green line

• because we have click on Port A(column)/46481 the filter(Green line) include the port( && tcp.port==46481 )

  

Back to Content

Page-5: Coloring rules

• Go inside ==> View / Coloring Rules....

  

• Here you can see & modify if you want to, all of the coloring rules.

Back to Content

Page-6: Packet diagram

• Go inside ==> Edit / Preferences...

  

• Go inside ==> Appearance / Layout

  

• One thing that is kind of newer feature of Wireshark that people like to see sometimes.

  • click ok to apply the changes.

• You can see how this packet is structured, really good for Educational purposes.

  • You can see the actual structure of the packet, How many bytes it is, How the bytes are structured.

Back to Content

Page-7: Delta time

• Go inside ==> Edit / Preferences...

  

• Go inside ==> Appearance / Columns

  

  • New line will appear
  • Double-click on New column(inside Title) to rename it (Delta)
  • Double-click on Custom(inside Type) & select (Delta time)

• click ok to apply the changes.

• Click on this Black-grey rectangle if your Delta Column is not visible

• you can also drag & drop to change it's position(in columns)

Back to Content

What to look for ?

• Generally:

  1. Look & see if your computer, is having any long conversations with an unknown device.
  2. try to discover what is the purpose of the communication is or what device it's trying to communicate with.
  3. you might want to look at HTTP & not encrypted level HTTPs.
  4. Red & Black Color packets, If you're looking for something on any network, these are good places to start.

• ex 1: Device Not Connecting a device not working on your network, & maybe you can use Wireshark to see if there's any communication at all.

• ex 2: Phishing Investigation may be someone at your organization think they have been phished, So you want to reopen the link that they got in the sketchy email while capturing with Wireshark, obviously on a safe machine, to see what information can be gathered.

• ex 3: Increase Bandwidth maybe just to see what devices are canstantly communicating on your network to see if you can improve your bandwidth.

• Wireshark can help with all of these situations, but the filters that you use & the packets that you focus on will be different.

Back to Content

Important Filters

• This Section is more helpful for advanced users.

• Filter-1: Hide protocols

  • Is a general filter that will hide less commonly looked protocols.
  • !(add all the filters that we don't want see)
  • !(arp or stp or lldp or cdp)
  • You can also add other protocols like UDP & TCP
  • !(arp or stp or lldp or cdp or udp or tcp)

• Filter-2: Show flagged packets

  1. You can see all of your TCP SYN flags, aka the first part of the three-way handshake.
     • tcp.flags.syn==1
     • How can we see just the stuff that Wireshark flagged ?
  2. tcp.analysis.flags
     • Now we're only seeing the flagged packets from Wireshark.
     • Those who like just using for the first time & you're like worried that there's something going on in your network or something, you might want to start here.
     • These are just kind of dropped packets and Retransmissions, fast Retransmissions, Spurious Retransmissions.

• Filter-3: Connection releases

  • To see if there are any specific packets that are from like an abortive release, aka one of your devices said, "No, I am not talking to you go away" which ia often a Red Flag.
  • tcp.flags.reset==1

Back to Content

Example & Exercises

• Web Link
• GitHub Link