Packet analysis with Wireshark : leverage the power of Wireshark to troubleshoot your networking issues by using effective packet analysis techniques and performing an improved protocol analysis / Anish Nath.

Format:

Book

Author/Creator:

Nath, Anish, author.

Series:

Community experience distilled.

Community experience distilled

Language:

English

Subjects (All):

Computer networks--Maintenance and repair.

Computer networks.

Computer networks--Management.

Computer network protocols.

Computer networks--Security measures.

Physical Description:

1 online resource (172 p.)

Edition:

1st edition

Place of Publication:

Birmingham : Packt Publishing, 2015.

System Details:

text file

Biography/History:

NATH ANISH: The Author has youtube channel http: //youtube. com/zarigatongy where loved to post videos on security, hacking and other cloud related technology

Summary:

Leverage the power of Wireshark to troubleshoot your networking issues by using effective packet analysis techniques and performing improved protocol analysis About This Book Gain hands-on experience of troubleshooting errors in TCP/IP and SSL protocols through practical use cases Identify and overcome security flaws in your network to get a deeper insight into security analysis This is a fast-paced book that focuses on quick and effective packet captures through practical examples and exercises Who This Book Is For If you are a network or system administrator who wants to effectively capture packets, a security consultant who wants to audit packet flows, or a white hat hacker who wants to view sensitive information and remediate it, this book is for you. This book requires decoding skills and a basic understanding of networking. What You Will Learn Utilize Wireshark's advanced features to analyze packet captures Locate the vulnerabilities in an application server Get to know more about protocols such as DHCPv6, DHCP, DNS, SNMP, and HTTP with Wireshark Capture network packets with tcpdump and snoop with examples Find out about security aspects such as OS-level ARP scanning Set up 802.11 WLAN captures and discover more about the WAN protocol Enhance your troubleshooting skills by understanding practical TCP/IP handshake and state diagrams In Detail Wireshark provides a very useful way to decode an RFC and examine it. The packet captures displayed in Wireshark give you an insight into the security and flaws of different protocols, which will help you perform the security research and protocol debugging. The book starts by introducing you to various packet analyzers and helping you find out which one best suits your needs. You will learn how to use the command line and the Wireshark GUI to capture packets by employing filters. Moving on, you will acquire knowledge about TCP/IP communication and its use cases. You will then get an understanding of the SSL/TLS flow with Wireshark and tackle the associated problems with it. Next, you will perform analysis on application-related protocols. We follow this with some best practices to analyze wireless traffic. By the end of the book, you will have developed the skills needed for you to identify packets for malicious attacks, intrusions, and other malware attacks. Style and approach This is an easy-to-follow guide packed with illustrations and equipped with lab exercises to help you reproduce scenarios u...

Contents:

Cover

Copyright

Credits

About the Author

About the Reviewers

www.PacktPub.com

Table of Contents

Preface

Chapter 1: Packet Analyzers

Uses for packet analyzers

Introducing Wireshark

Wireshark features

Wireshark's dumpcap and tshark

The Wireshark packet capture process

Other packet analyzer tools

Mobile packet capture

Summary

Chapter 2: Capturing Packets

Guide to capturing packets

Capturing packets with Interface Lists

Common interface names

Capturing packets with Start options

Capturing packets with Capture Options

The capture filter options

Auto-capturing a file periodically

Troubleshooting

Wireshark user interface

The Filter toolbar

Filtering techniques

Filter examples

The Packet List pane

The Packet Details pane

The Packet Bytes pane

Decode-As

Protocol preferences

The IO graph

Following the TCP stream

Exporting the displayed packet

Generating the firewall ACL rules

Tcpdump and snoop

References

Chapter 3: Analyzing the TCP Network

Recapping TCP

TCP header fields

TCP states

TCP connection establishment and clearing

TCP three-way handshake

Handshake message - first step [SYN]

Handshake message - second step [SYN, ACK]

Handshake message - third step [ACK]

TCP data communication

TCP close sequence

Lab exercise

TCP troubleshooting

TCP reset sequence

RST after SYN-ACK

RST after SYN

TCP CLOSE_WAIT

TCP TIME_WAIT

TCP latency issues

Cause of latency

Identifying latency

Server latency example

Wire latency

Wireshark TCP sequence analysis

TCP retransmission

TCP ZeroWindow

TCP Window Update

TCP Dup-ACK

Chapter 4: Analyzing SSL/TLS

Introducing SSL/TLS.

SSL/TLS versions

The SSL/TLS component

The SSL/TLS handshake

Types of handshake message

Client Hello

Server Hello

Server certificate

Server Key Exchange

Client certificate request

Server Hello Done

Client certificate

Client Key Exchange

Client Certificate Verify

Change Cipher Spec

Finished

Application Data

Alert Protocol

Key exchange

The Diffie-Hellman key exchange

Elliptic curve Diffie-Hellman key exchange

RSA

Decrypting SSL/TLS

Decrypting RSA traffic

Decrypting DHE/ECHDE traffic

Forward secrecy

Debugging issues

Chapter 5: Analyzing Application Layer Protocols

DHCPv6

DHCPv6 Wireshark filter

Multicast addresses

The UDP port information

DHCPv6 message types

Message exchanges

The four-message exchange

The two-message exchange

DHCPv6 traffic capture

BOOTP/DHCP

BOOTP/DHCP Wireshark filter

Address assignment

Capture DHCPv4 traffic

DNS

DNS Wireshark filter

Port

Resource records

DNS traffic

HTTP

HTTP Wireshark filter

HTTP use cases

Finding the top HTTP response time

Finding packets based on HTTP methods

Finding sensitive information in a form post

Using HTTP status code

Chapter 6: WLAN Capturing

WLAN capture setup

The monitor mode

Analyzing the Wi-Fi networks

Frames

Management frames

Data frames

Control frames

802.11 auth process

802.1X EAPOL

The 802.11 protocol stack

Wi-Fi sniffing products

Chapter 7: Security Analysis

Heartbleed bug

The Heartbleed Wireshark filter

Heartbleed Wireshark analysis

The Heartbleed test

Heartbleed recommendations

The DOS attack

SYN flood

SYN flood mitigation

ICMP flood

ICMP flood mitigation

SSL flood

Scanning

Vulnerability scanning

SSL scans.

ARP duplicate IP detection

DrDoS

BitTorrent

Wireshark protocol hierarchy

Index.

Notes:

Includes index.

Description based on online resource; title from PDF title page (ebrary, viewed January 12, 2016).

ISBN:

9781785885846

1785885847

OCLC:

933389359