Setting Up and Using Wireshark on Mac OS X (Leopard)

Transcription

1 ECE 480 Team 3 Setting Up and Using Wireshark on Mac OS X (Leopard) Application Note Zach Menard

2 TABLE OF CONTENTS Introduction to Wireshark.2 Where to Download..2 What is Needed to Install 3 How to Install...3 How to Allow Permissions.5 Opening Wireshark for the First Time 5 Selection Network Interface...6 Promiscuous Mode Capture 8 Conclusions.8 References...9 PAGE 1

3 Introduction to Wireshark Wireshark in its general meaning is a open source program which captures packets and analyzes them. Wireshark simply works much like tcpdump works and allows for a graphical interface to layout different packets that are captured and display them in a neat and defined grouping. Wireshark is very beneficial in that it allows for user configuration of a operation mode called promiscuous mode in order to see all traffic on a specific network interface. In a non-promiscuous mode, the network interface recieves packets and simply ignores them if the destination MAC address does not correspond to the MAC address of the network interface. However, in this promiscuous mode that Wireshark allows, the network interface does not care if the destination is another device or network. Instead, the network interface keeps the packet and allows it to be dumped into Wiresharks interface. Another mode which Wireshark allows is called monitor mode. Although its is much like promiscuous mode, monitor mode allows the network interface to capture packets which are not access points or Ad-hoc network. Also, were promiscuous mode monitors both wired and wireless networks, monitor mode only allows for wireless networks to be captured. Where to Download Wireshark As stated previously, Wireshark is an open source program and allows for free downloads of their software to Unix-based and Windows devices. To receive a free copy of Wireshark, it is as simple as going to Wireshark s website and downloading a copy based on the correct operating system. For this application note, the install and download of Wireshark will be demonstrated for a computer running Mac OS X (Leopard). PAGE 2

4 What is Needed for Install The first thing needed to install Wireshark on OS X is to install the X11 application. This application necessary to provide a graphical user interface for OS X. The next thing to do is to go to the Wireshark website and download the appropriate Apple disk image file. For this application, downloading of verison is shown. Figure 1 How to Install After the.dmg file is downloaded, unpacking of the image is required and an image like the one below in Figure 2 should appear. Next, locating the Wireshark.app and dragging it into the Applications folder is required as showed in the image as well below in Figure 2. PAGE 3

5 Figure 2 Once this is complete, Terminal will need to be opened. Terminal is located in the Applications folder label Utilities (not to be confused with the Utilities folder above in Figure 2). In terminal the following code will need to be executed to allow for hidden folders to be displayed: defaults write com.apple.finder Apple ShowAllFiles YES. Once this is inputted hitting enter will execute the command, however in order to view the hidden folders it is necessary to restart Finder. To do this type: killall Finder. These two steps are shown below in Figure 3. Figure 3 From Figure 2 above, all of the executable files located in Utilities will need to be dragged to the path that was made visible: /usr/local/bin. Once this in done, Wireshark is almost ready to be run. To get rid of the hidden folders that were made visible simply PAGE 4

6 repeat the commands in Figure 3 but instead of ShowAllFiles YES, type ShowAllFiles NO followed by restarting the Finder. How to Allow Permissions At this point if Wireshark is run, the X11 application will open and Wireshark s graphical interface will be produced. However, no network interfaces will be accessable. To allow permission to access Mac s Airport card a simple line of code will solve the problem. Simply type sudo 644 /dev/bpf* and hit enter. This will not, however, execute until the administrators password is inputted. This step is show below in Figure 4. Figure 4 Opening Wireshark for the First Time Since the Terminal is already open, Wireshark can be opened by opening the Applications folder using cd /Applications and then typing open Wireshark.app. Figure 5 Wireshark should now be open and look similar to the screen capture below in Figure 6. If this is not the case check to make sure you followed the steps defined in How to Install. PAGE 5

7 Figure 6 Selecting a Network Interface As shown in Figure 6, 4 network interfaces should show up. To show these in a clearer menu, use the menu bar and select Capture and then click on Interfaces. This will bring up a window like the one in Figure 7. Figure 7 PAGE 6

8 To have an understanding of which device to use a definition of each interface is necessary. en0 wired Ethernet network interface fw0 wired FireWire network interface en1 wireless Airport network interface card lo0 virtual network interface loopback (traffic from the machine itself) Now that it is clear which interface is which, selecting the options tab for en1 will bring up a window much like Figure 8. Figure 8 PAGE 7

9 Promiscuous Mode Capture These options should be configured including checking to make sure Wireshark is capturing packets in promiscuous mode as shown in Figure 8. Next, it is now time to run Wireshark to start capturing packets. To do this simply hit START at the bottom of the options window and this should bring up a window much like that of Figure 9. Figure 9 Conclusion In this application note, Wireshark was introduced and showed its capability to capture packets from a specific network interface. Step-by-step instructions were then shown to allow Mac OS X users to download and install Wireshark to use it in an effective manner. Next, a description of each network interface was given and allowed for proper selection and final running of Wireshark to show its ability to capture packets. PAGE 8

10 References PAGE 9