1. Whatdo you use? 2. Speed Tests?

Transcription

1 Session Title: Network Traffic Analysis -- It's not just for fun anymore. Session Type: 50 Min. Breakout Session Presentation Day: Tuesday, February 11 Network Traffic Analysis It s not just for fun anymore. As network availability becomes more critical to an organization s daily operations, it is increasingly important that the network administrators know how to monitor and analyze network traffic in order to effectively troubleshoot and resolve issues. There are a number of tools available many of which are free --to help do this. In this session I ll demonstrate how to use Wireshark--one of the most popular tools used for traffic analysis to capture and analyze traffic to see what s happening on your network. We ll discuss the basics of what to look for in the packet capture and how to interpret what you see. We ll also cover how you can use log files from other sources to confirm or dispute your findings. 1

2 Introductions House Cleaning 1. Please turn off cell phones, pagers. 2. Ask Questions anytime during the presentation 3. Anything specific you re wanting to take away from this session? 2

3 3

4 4

5 1. Whatdo you use? 2. Speed Tests? 5

6 6

7 7

8 Is there anyone who has never seen or installed Wireshark? How many of you use Wiresharkonce or twice a year? How many of you have use Wiresharkon a regular basis? What are some of your biggest challenges with Wireshark or any packet capture/sniffing application? Wireshark can be used to Troubleshoot slow networks or applications Identify application protocols and ports Identify rogue devices Determine if a device is infected with a virus or malware Wireshark Features Works on multiple platforms Windows, Mac, Linux Live capture or offline analysis Capture Filters and Display Filters Customized Preferences Output data to various formats Built In Analysis and Statistic Tools Wireshark Isn t Wiresharkis not an IDS or IPS No Alerts Wireshark doesn t alter network traffic. Passive Only listens and observes. Wireshark isn't an intrusion detection system. It will not warn you when someone does strange things on your network that he/she isn't allowed to do. However, if strange things happen, Wireshark might help you figure out what is really going on. Wireshark will not manipulate things on the network, it will only "measure" things from it. Wireshark doesn't send packets on the network or do other active things (except for name 8

9 resolutions, but even that can be disabled) 8

10 9

11 10

12 11

13 A new Wireshark version will typically become available every 4-8 months Whenpatches and new versions are made available, they often contain fixes and new features and functionality. 12

14 When you start capturing traffica tool called dumpcapis launched to do the actual capturing. Frames are passed up from the network, through one of the special link-layer drivers directly to Wireshark scapture Engine. The Capture Engine then passes frames up to the Core Engine. This is where Wireshark spower becomes evident. Wiresharksupports thousands of dissectors that translate the incoming bytes into human-readable format frames. The dissectors break apart the fields in the frames and often perform analysis on the content of those fields. 13

15 1. Troubleshooting purposes you will probably want to place Wiresharkas close to the problem as possible. 2. Security Incidentcan either be visible malware, virus, compromise or invisible want to find out who s doing what. 3. Continuous Network Monitoring Identify possible problems before they happen. 14

16 Prepare and practice yourcapture process well in advance. You don t want to run around looking for switch port spanning configuration information while people are screaming about network problems. 1. You have a device that s acting suspicious-- Wireshark can be installed on the System itself. 2. In most cases you ll want to install Wiresharkon a portable device so you can move it to different locations in your network. Working with a busy network can easily produce huge memory and disk space usage! For example: Capturing on a fully saturated 100MBit/s Ethernet will produce ~ 750MBytes/min! Having a fast processor, lots of memory and disk space is a good idea in that case Windows XP Home, XP Pro, XP Tablet PC, XP Media Center, Server 2003, Vista, Home Server, Server 2008, Server 2008 R2, Home Server 2011, 7, or Server Any modern 32-bit x86 or 64-bit AMD64/x86-64 processor. 128MB available RAM. Larger capture files require more RAM. 75MB available disk space. Capture files require additional disk space. 800*600 (1280*1024 or higher recommended) resolution with at least (16bit) colors (256 colors should work if Wireshark is installed with the "legacy GTK1" selection of the Wireshark 1.0.x releases) A supported network card for capturing: 15

17 16

18 17

19 Packet List Pane is a one line summary of each packet. By clicking on packets in this pane you control whatis displayed in the other two panes. 18

20 19

21 If no interfaces are visible, there could be a problem with the WinPcap driver. If you see 0 in the Packets column, then the adapter is not beingused. If you have IPv6 enabled on the device, Wiresharkwill show you the IPv6 address of each adapter by default. Click on the IPv6 address to see the IPv4 address. Starting with Wireshark1.8 you can capture on two or more interfaces at the same time. This is useful if you want to capture on the wired and wireless network simultaneously. 20

22 21

23 Noteof Caution: Use CaptureFilters sparingly. There are other methods to control the amount of data collected. Packets that do not match the Capture filter are discarded. Gone forever. You can focus on specific traffic IP Address Range of IP Addresses MAC Address Protocols and Ports DNS HTTP TCP Port 25 22

24 23

25 1. RingBuffers are typically used for capturing traffic over extended periods of time. 2. NOTE: Wireshark maintains many of the capture options. Before starting a capture especially if you haven t closed Wireshark, check the Capture Files settings. 24

26 25

27 26

28 1. Update list of packets in realtime This option will immediately display the captured packets in the Packet List window. NOTE: May slow down the capture process so packets drops may be encountered. 2. When used in conjunction with the Update list option, the Packet List window will continue to scroll to highlight the last captured packet. 3. This will hide the capture info dialog during capture. 27

29 1. MAC Addresses On by default. Resolves the first three bytes of a MAC address to a manufacturer. 2. Network-layer Off by default. Resolves IP address to a host name. This can generate a series of DNS pointer queries. Can be configured to look at a host file. 3. Transport-layer On by default. Resolves port numbers to port names 80=http 4. External Will use the system s configured DNS resolver to determine network names. 28

30 If Wiresharkseems to be slow or droppingpackets, any configuration that consumes extra processing power should be looked to see if it can be disabled. 29

31 30

32 31

33 32

34 1. Number Each frame is assigned a number. Default issorted from low to high. 2. Time Arrival time of frame compared to the first. 3. Source and Destination Highest layer address available. MAC addresses will show for frames with no other information. Example ARP. 4. Protocol Displays the last dissector applied to frame. Good place to determine application associated with traffic i.e. HTTP, DNS, etc. 5. Length Total length of each frame. 6. Info Shows basic information i.e. HTTP GET, DNS Query, etc. 33

35 34

36 Dissectors are the Wiresharksoftware elements that break apart applications and protocols to display their field names and interpreted values. Each dissector decodes and displays the pertinentinformation and then based on specifics hands the packet off to the next dissector. 35

37 36

38 37

39 38

40 Wiresharkuses the same syntax for capture filters as tcpdump, WinDump, Analyzer, and any other program that uses the libpcap/winpcaplibrary. The next Wireshark How-To Series focuses on Display Filters. 39

41 40

42 41

43 42

44 YOU MUST HAVE AN INTERFACE SELECTED!!!! This is only done when creatinga filter in the Capture Options Window. 43

45 44

46 You can also use IPv6 addresses. 45

47 You can use ether srcand ether dstalso. 46

48 47

49 48

50 49

51 50

52 Greater than or Equal to ge. >= Less than or Equal to le, <= 51

53 Expressions can be grouped by parentheses as well. 52

54 53

55 54

56 55

57 56

58 NOTE: I ll talk about this more ina little bit. 57

59 58

60 59

61 60

62 ip.addr== [Sets a filter for any packet with , as either the source or dest] 2. ip.addr== && ip.addr== [sets a conversation filter between the two defined IP addresses] 3. httpordns [sets a filter to display all http and dns] 4. tcp.port==4000 [sets a filter for any TCP packet with 4000 as a source or destport] 5. tcp.flags.reset==1 [displays all TCP resets] 6. http.request [displays all HTTP GET requests] 7. tcpcontains traffic [displays all TCP packets that contain the word traffic. Excellent when searching on a specific string or user ID] 8.!(arpor icmpor dns)[masks out arp, icmp, dns, or whatever other protocols may be background noise. Allowing you to focus on the traffic of interest] 9. udpcontains 33:27:58 [sets a filter for the HEX values of 0x33 0x27 0x58 at any offset] 10. tcp.analysis.retransmission [displays all retransmissions in the trace. Helps when tracking down slow application performance and packet loss] 61

63 62

64 63

65 A special caveat must be given regarding fields that occur more than once per packet. "ip.addr" occurs twice per IP packet, once for the source address, and once for the destination address. Likewise, "tr.rif.ring" fields can occur more than once per packet. The following two expressions are not equivalent: 64

66 Do not use with afield name that matches more than one field. 65

67 66

68 67

69 1. Preferences Edit/Preferences 2. Dfilters Display Filters 3. Cfilters Capture Filters 4. Colorfilters Coloring Rules 5. Recent contains settings such as column width, toolbar visibility, directorylast used for opening trace files. NOTE: Some text files may contain directory paths which could cause errors if copied to other systems. 68

70 69

71 You can switch to another profile by right-clicking onprofile in the task bar and choosing switch to. 70

72 71

73 Beaware that when you copy or export a profile to another device, the directory structure may cause some errors i.e. c:\users\username\etc. 72

74 73

75 IP Subnets 74

76 Edit/Preferences 75

77 The default columns in Wireshark are No., Time, Source, Destination, Protocol, Info. 76

78 The new column will be added onthe right. Right click the column heading to remove, rename, or reposition. 77

79 This can be done via Preferences or the Capture Options Window. 78

80 79

81 Don t forget right-click functionality for creating display filters. Then just click Save. 80

82 19 Coloring Rules are enabled by default. They are identifiedby a name, string, background color and foreground color. 81

83 82

84 83

85 84

86 Show resources from Help 85

87 86

88 87

89 88