Skip to Main Content
Instant Traffic Analysis with Tshark How-to
book

Instant Traffic Analysis with Tshark How-to

by Borja Merino
April 2013
Intermediate to advanced content levelIntermediate to advanced
68 pages
1h 32m
English
Packt Publishing
Content preview from Instant Traffic Analysis with Tshark How-to

Auditing network attacks (Become an expert)

In this recipe you will learn how to identify well-known network attacks. Some of these attacks can have serious consequences in environments that do not implement appropriate countermeasures. We'll see how, with some skill with Tshark and by applying the correct filters, we can detect most of these attacks.

How to do it...

The examples that follow show how to detect some network attacks (internal and external) using just Tshark from the command line.

ARP spoofing

  1. If you suspect that someone is playing with ARP traffic, it would be advisable to run Tshark in SPAN or HUB mode (see the Capturing traffic (Must know) recipe). Subsequently, a good start would be to look at the rate of ARP reply packets:
    bmerino@Mordor:~$ ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Next Generation Red Teaming

Next Generation Red Teaming

Henry Dalziel
Wireshark & Ethereal Network Protocol Analyzer Toolkit

Wireshark & Ethereal Network Protocol Analyzer Toolkit

Jay Beale, Angela Orebaugh, Gilbert Ramirez

Publisher Resources

ISBN: 9781782165385Other