Network Analysis Using Wireshark 2 Cookbook - Second Edition

Network Analysis Using Wireshark 2 Cookbook - Second Edition

by Nagendra Kumar Nainar, Yogesh Ramdoss, Yoram Orzach
Released March 2018
Publisher(s): Packt Publishing
ISBN: 9781786461674

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Over 100 recipes to analyze and troubleshoot network problems using Wireshark 2

About This Book

  • Place Wireshark 2 in your network and configure it for effective network analysis
  • Deep dive into the enhanced functionalities of Wireshark 2 and protect your network with ease
  • A practical guide with exciting recipes on a widely used network protocol analyzer

Who This Book Is For

This book is for security professionals, network administrators, R&D, engineering and technical support, and communications managers who are using Wireshark for network analysis and troubleshooting. It requires a basic understanding of networking concepts, but does not require specific and detailed technical knowledge of protocols or vendor implementations.

What You Will Learn

  • Configure Wireshark 2 for effective network analysis and troubleshooting
  • Set up various display and capture filters
  • Understand networking layers, including IPv4 and IPv6 analysis
  • Explore performance issues in TCP/IP
  • Get to know about Wi-Fi testing and how to resolve problems related to wireless LANs
  • Get information about network phenomena, events, and errors
  • Locate faults in detecting security failures and breaches in networks

In Detail

This book contains practical recipes on troubleshooting a data communications network. This second version of the book focuses on Wireshark 2, which has already gained a lot of traction due to the enhanced features that it offers to users. The book expands on some of the subjects explored in the first version, including TCP performance, network security, Wireless LAN, and how to use Wireshark for cloud and virtual system monitoring. You will learn how to analyze end-to-end IPv4 and IPv6 connectivity failures for Unicast and Multicast traffic using Wireshark. It also includes Wireshark capture files so that you can practice what you've learned in the book. You will understand the normal operation of E-mail protocols and learn how to use Wireshark for basic analysis and troubleshooting. Using Wireshark, you will be able to resolve and troubleshoot common applications that are used in an enterprise network, like NetBIOS and SMB protocols. Finally, you will also be able to measure network parameters, check for network problems caused by them, and solve them effectively. By the end of this book, you'll know how to analyze traffic, find patterns of various offending traffic, and secure your network from them.

Style and approach

This book consists of practical recipes on Wireshark 2 that target novices as well as intermediate Wireshark users. It goes deep into the technical issues, covers additional protocols, and many more real-live examples so that you are able to implement it in your daily life scenarios.

Publisher resources

View/Submit Errata

Table of contents

  1. Title Page
  2. Copyright and Credits
    1. Network Analysis Using Wireshark 2 Cookbook Second Edition
  3. Dedication
  4. Packt Upsell
    1. Why subscribe?
    2. PacktPub.com
  5. Contributors
    1. About the authors
    2. About the reviewer
    3. Packt is searching for authors like you
  6. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
      1. Download the color images
      2. Conventions used
    4. Sections
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    5. Get in touch
      1. Reviews
  7. Introduction to Wireshark Version 2
    1. Wireshark Version 2 basics
    2. Locating Wireshark
      1. Getting ready
      2. How to do it...
        1. Monitoring a server
        2. Monitoring a router
        3. Monitoring a firewall
        4. Test access points and hubs
      3. How it works...
      4. There's more...
      5. See also
    3. Capturing data on virtual machines
      1. Getting ready
      2. How to do it...
        1. Packet capture on a VM installed on a single hardware
        2. Packet capture on a blade server
      3. How it works...
        1. Standard and distributed vSwitch
      4. See also
    4. Starting the capture of data
      1. Getting ready
      2. How to do it...
        1. Capture on multiple interfaces
        2. How to configure the interface you capture data from
        3. Capture data to multiple files
        4. Configure output parameters
        5. Manage interfaces (under the Input tab)
        6. Capture packets on a remote machine
        7. Start capturing data – capture data on Linux/Unix machines
        8. Collecting from a remote communication device
      3. How it works...
      4. There's more...
      5. See also
    5. Configuring the start window
      1. Getting ready
        1. The main menu
        2. The main toolbar
        3. Display filter toolbar
        4. Status bar
      2. How to do it...
        1. Toolbars configuration
        2. Main window configuration
        3. Name resolution
        4. Colorize packet list
        5. Zoom
  8. Mastering Wireshark for Network Troubleshooting
    1. Introduction
    2. Configuring the user interface, and global and protocol preferences
      1. Getting ready
      2. How to do it...
        1. General appearance preferences
        2. Layout preferences
        3. Column preferences
        4. Font and color preferences
        5. Capture preferences
        6. Filter expression preferences
        7. Name resolution preferences
        8. IPv4 preference configuration
        9. TCP and UDP configuration
      3. How it works...
      4. There's more...
    3. Importing and exporting files
      1. Getting ready
      2. How to do it...
        1. Exporting an entire or partial file
        2. Saving data in various formats
        3. Printing data
      3. How it works...
      4. There's more...
    4. Configuring coloring rules and navigation techniques
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. See also
    5. Using time values and summaries
      1. Getting ready
      2. How to do it...
      3. How it works...
    6. Building profiles for troubleshooting
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
  9. Using Capture Filters
    1. Introduction
    2. Configuring capture filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    3. Configuring Ethernet filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    4. Configuring hosts and network filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    5. Configuring TCP/UDP and port filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    6. Configuring compound filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    7. Configuring byte offset and payload matching filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
  10. Using Display Filters
    1. Introduction
    2. Configuring display filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    3. Configuring Ethernet, ARP, host, and network filters
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. See also
    4. Configuring TCP/UDP filters
      1. Getting ready
        1. TCP and UDP port number display filters
        2. TCP header filters
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    5. Configuring specific protocol filters
      1. Getting ready
      2. How to do it...
        1. HTTP display filters
        2. DNS display filters
        3. FTP display filters
      3. How it works...
      4. See also
    6. Configuring substring operator filters
      1. Getting ready
      2. How to do it...
      3. How it works...
    7. Configuring macros
      1. Getting ready
      2. How to do it...
      3. How it works...
  11. Using Basic Statistics Tools
    1. Introduction
    2. Using the statistics – capture file properties menu
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    3. Using the statistics – resolved addresses
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more
    4. Using the statistics – protocol hierarchy menu
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    5. Using the statistics – conversations menu
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    6. Using the statistics – endpoints menu
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    7. Using the statistics – HTTP menu
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    8. Configuring a flow graph for viewing TCP flows
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    9. Creating IP-based statistics
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
  12. Using Advanced Statistics Tools
    1. Introduction
    2. Configuring I/O graphs with filters for measuring network performance issues
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    3. Throughput measurements with I/O graphs
      1. Getting ready
      2. How to do it...
        1. Measuring download/upload traffic
        2. Measuring several streams between two end devices
        3. Measuring application throughput
        4. Measuring a TCP stream with TCP event analysis
      3. How it works...
      4. There's more...
    4. Advanced I/O graph configurations with y axis parameters
      1. Getting ready
      2. How to do it...
        1. Monitoring inter-frame time delta statistics
        2. Monitoring the number of TCP events in a stream
        3. Monitoring the number of field appearances
      3. How it works...
      4. There's more...
    5. Getting information through TCP stream graphs – time/sequence (Steven's) window
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    6. Getting information through TCP stream graphs – time/sequences (TCP-trace) window
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    7. Getting information through TCP stream graphs – throughput window
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    8. Getting information through TCP stream graphs – round-trip-time window
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    9. Getting information through TCP stream graphs – window-scaling window
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
  13. Using the Expert System
    1. Introduction
    2. The expert system window and how to use it for network troubleshooting
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    3. Error events and what we can understand from them
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    4. Warning events and what we can understand from them
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    5. Note events and what we can understand from them
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
  14. Ethernet and LAN Switching
    1. Introduction
    2. Discovering broadcast and error storms
      1. Getting ready
      2. How to do it...
        1. Spanning tree problems
        2. A device that generates broadcasts
        3. Fixed pattern broadcasts
      3. How it works...
      4. There's more...
      5. See also
    3. Analyzing spanning tree problems
      1. Getting ready
      2. How to do it...
        1. Which STP version is running on the network?
        2. Are there too many topology changes?
      3. How it works...
        1. Port states
      4. There's more...
    4. Analyzing VLANs and VLAN tagging issues
      1. Getting ready
      2. How to do it...
        1. Monitoring traffic inside a VLAN
        2. Viewing tagged frames going through a VLAN tagged port
      3. How it works...
      4. There's more...
      5. See also
  15. Wireless LAN
    1. Skills learned
    2. Introduction to wireless networks and standards
      1. Understanding WLAN devices, protocols, and terminologies
      2. Access point (AP)
      3. Wireless LAN controller (WLC)
    3. Wireless radio issues, analysis, and troubleshooting
      1. Getting ready
      2. How to do it...
        1. Zero wireless connectivity
        2. Poor or intermittent wireless connectivity
    4. Capturing wireless LAN traffic
      1. Capturing options
      2. Getting ready
      3. How to do it...
        1. Wireless station not joining a specific SSID
        2. Users not able to authenticate after successful association
      4. There's more...
  16. Network Layer Protocols and Operations
    1. Introduction
      1. The IPv4 principles of operations
      2. IP addressing
    2. IPv4 address resolution protocol operation and troubleshooting
      1. Getting ready
      2. How to do it...
        1. ARP attacks and mitigations
          1. ARP poisoning and man-in-the-middle attacks
          2. Gratuitous ARP
          3. ARP sweep-based DoS attacks
      3. How it works...
    3. ICMP – protocol operation, analysis, and troubleshooting
      1. Getting ready
      2. How to do it...
        1. ICMP attacks and mitigations
        2. ICMP flood attack
          1. ICMP smurf attack
      3. How it works...
    4. Analyzing IPv4 unicast routing operations
      1. Getting ready
      2. How it works...
        1. IP TTL failures and attacks
        2. Duplicate IP addresses
    5. Analyzing IP fragmentation failures
      1. TCP path MTU discovery
      2. How to do it...
        1. Fragmentation-based attack
      3. How it works...
    6. IPv4 multicast routing operations
      1. How it works...
      2. There's more...
    7. IPv6 principle of operations
      1. IPv6 addressing
    8. IPv6 extension headers
      1. IPv6 extension headers and attacks
      2. Getting ready
      3. How to do it...
        1. IPv6 fragmentation
      4. How it works...
    9. ICMPv6 – protocol operations, analysis, and troubleshooting
      1. Getting ready
      2. How to do it...
    10. IPv6 auto configuration
      1. Getting ready
      2. How to do it...
      3. How it works...
    11. DHCPv6-based address assignment
      1. Getting ready
      2. How to do it...
      3. How it works...
    12. IPv6 neighbor discovery protocol operation and analysis
      1. How to do it...
        1. IPv6 duplicate address detection
      2. How it works...
  17. Transport Layer Protocol Analysis
    1. Introduction
    2. UDP principle of operation
    3. UDP protocol analysis and troubleshooting
      1. Getting ready
      2. How to do it...
    4. TCP principle of operation
    5. Troubleshooting TCP connectivity problems
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    6. Troubleshooting TCP retransmission issues
      1. Getting ready
      2. How to do it...
        1. Case 1 – retransmissions to many destinations
        2. Case 2 – retransmissions on a single connection
        3. Case 3 – retransmission patterns
        4. Case 4 – retransmission due to a non-responsive application
        5. Case 5 - retransmission due to delayed variations
        6. Finding out what it is
      3. How it works...
        1. Regular operation of the TCP sequence/acknowledge mechanism
        2. What are TCP retransmissions and what do they cause?
      4. There's more...
      5. See also
    7. TCP sliding window mechanism
      1. Getting ready
      2. How to do it...
      3. How it works...
    8. TCP enhancements – selective ACK and timestamps
      1. Getting ready
      2. How to do it...
        1. TCP selective acknowledgement option
        2. TCP timestamp option
      3. How it works...
        1. TCP selective acknowledgement
        2. TCP timestamp
      4. There's more...
    9. Troubleshooting TCP throughput
      1. Getting ready
      2. How to do it...
      3. How it works...
  18. FTP, HTTP/1, and HTTP/2
    1. Introduction
    2. Analyzing FTP problems
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    3. Filtering HTTP traffic
      1. Getting ready
      2. How to do it...
      3. How it works...
        1. HTTP methods
        2. Status codes
      4. There's more...
    4. Configuring HTTP preferences
      1. Getting ready
      2. How to do it...
        1. Custom HTTP headers fields
      3. How it works...
      4. There's more...
    5. Analyzing HTTP problems
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    6. Exporting HTTP objects
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    7. HTTP flow analysis
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    8. Analyzing HTTPS traffic – SSL/TLS basics
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
  19. DNS Protocol Analysis
    1. Introduction
    2. Analyzing DNS record types
      1. Getting ready
      2. How to do it...
      3. How it works...
        1. SOA record
        2. A resource record
        3. AAAA resource record
        4. CNAME resource record
      4. There's more...
    3. Analyzing regular DNS operations
      1. Getting ready
      2. How to do it...
      3. How it works...
        1. DNS server assignment
        2. DNS operation
        3. DNS namespace
        4. The resolving process
      4. There's more...
    4. Analyzing DNSSEC regular operations
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    5. Troubleshooting DNS performance
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
  20. Analyzing Mail Protocols
    1. Introduction
    2. Normal operation of mail protocols
      1. Getting ready
      2. How to do it...
        1. POP3 communications
        2. IMAP communications
        3. SMTP communications
      3. How it works...
        1. POP3
        2. IMAP
        3. SMTP
      4. There's more...
        1. SSL decryption in Wireshark
    3. Analyzing POP, IMAP, and SMTP problems
      1. Getting ready
      2. How to do it...
      3. How it works...
    4. Filtering and analyzing different error codes
      1. Getting ready
      2. How to do it...
        1. SMTP
        2. IMAP
        3. POP3
      3. How it works...
      4. There's more...
        1. IMAP response code (RFC 5530)
        2. POP3 response code (RFC 2449)
        3. SMTP and SMTP error codes (RFC 3463)
    5. Malicious and spam email analysis
      1. Getting ready
      2. How to do it...
      3. How it works...
  21. NetBIOS and SMB Protocol Analysis
    1. Introduction
    2. Understanding the NetBIOS protocol
    3. Understanding the SMB protocol
      1. How it works...
    4. Analyzing problems in the NetBIOS/SMB protocols
      1. Getting ready
      2. How to do it...
        1. General tests
        2. Specific issues
      3. There's more...
        1. Example 1 – application freezing
        2. Example 2 – broadcast storm caused by SMB
    5. Analyzing the database traffic and common problems
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    6. Exporting SMB objects
      1. Getting ready
      2. How to do it...
      3. How it works...
  22. Analyzing Enterprise Applications' Behavior
    1. Introduction
    2. Finding out what is running over your network
      1. Getting ready
      2. How to do it...
      3. There's more...
    3. Analyzing Microsoft Terminal Server and Citrix communications problems
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    4. Analyzing the database traffic and common problems
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    5. Analyzing SNMP
      1. Getting ready
      2. How to do it...
        1. Polling a managed device with a wrong SNMP version
        2. Polling a managed device with a wrong MIB object ID (OID)
      3. How it works...
      4. There's more...
  23. Troubleshooting SIP, Multimedia, and IP Telephony
    1. Introduction
    2. IP telephony principle and normal operation
      1. Getting ready
      2. How to do it...
        1. RTP operation
        2. RTCP operation
      3. How it works...
        1. RTP principles of operation
        2. The RTCP principle of operation
    3. SIP principle of operation, messages, and error codes
      1. Getting ready
      2. How to do it...
      3. How it works...
        1. 1xx codes – provisional/informational
        2. 2xx codes – success
        3. 3xx codes – redirection
        4. 4xx codes – client error
        5. 5xx codes – server error
        6. 6xx codes – global failure
    4. Video over IP and RTSP
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    5. Wireshark features for RTP stream analysis and filtering
      1. Getting ready
      2. How to do it...
      3. How it works...
    6. Wireshark feature for VoIP call replay
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
  24. Troubleshooting Bandwidth and Delay Issues
    1. Introduction
    2. Measuring network bandwidth and application traffic
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    3. Measurement of jitter and delay using Wireshark
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    4. Analyzing network bottlenecks, issues, and troubleshooting
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
  25. Security and Network Forensics
    1. Introduction
    2. Discovering unusual traffic patterns
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    3. Discovering MAC-based and ARP-based attacks
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    4. Discovering ICMP and TCP SYN/port scans
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
      5. See also
    5. Discovering DoS and DDoS attacks
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...
    6. Locating smart TCP attacks
      1. Getting ready
      2. How to do it
      3. How it works...
      4. There's more...
      5. See also
    7. Discovering brute force and application attacks
      1. Getting ready
      2. How to do it...
      3. How it works...
      4. There's more...

Product information

  • Title: Network Analysis Using Wireshark 2 Cookbook - Second Edition
  • Author(s): Nagendra Kumar Nainar, Yogesh Ramdoss, Yoram Orzach
  • Release date: March 2018
  • Publisher(s): Packt Publishing
  • ISBN: 9781786461674