book

Practical Packet Analysis, 3rd Edition

by Chris Sanders

March 2017

Beginner to intermediate

368 pages

9h 59m

English

No Starch Press

Read now

Unlock full access

Why This Book?Concepts and ApproachHow to Use This BookAbout the Sample Capture FilesThe Rural Technology FundContacting Me
Packet Analysis and Packet SniffersEvaluating a Packet SnifferHow Packet Sniffers WorkHow Computers CommunicateProtocolsThe Seven-Layer OSI ModelNetwork HardwareTraffic ClassificationsBroadcast TrafficMulticast TrafficUnicast TrafficFinal Thoughts
Living PromiscuouslySniffing Around HubsSniffing in a Switched EnvironmentPort MirroringHubbing OutUsing a TapARP Cache PoisoningSniffing in a Routed EnvironmentSniffer Placement in Practice
A Brief History of WiresharkThe Benefits of WiresharkInstalling WiresharkInstalling on Windows SystemsInstalling on Linux SystemsInstalling on OS X SystemsWireshark FundamentalsYour First Packet CaptureWireshark’s Main WindowWireshark PreferencesPacket Color CodingConfiguration FilesConfiguration Profiles

Working with Capture FilesSaving and Exporting Capture FilesMerging Capture FilesWorking with PacketsFinding PacketsMarking PacketsPrinting PacketsSetting Time Display Formats and ReferencesTime Display FormatsPacket Time ReferencingTime ShiftingSetting Capture OptionsInput TabOutput TabOptions TabUsing FiltersCapture FiltersDisplay FiltersSaving FiltersAdding Display Filters to a Toolbar
Endpoints and Network ConversationsViewing Endpoint StatisticsViewing Network ConversationsIdentifying Top Talkers with Endpoints and ConversationsProtocol Hierarchy StatisticsName ResolutionEnabling Name ResolutionPotential Drawbacks to Name ResolutionUsing a Custom hosts FileManually Initiated Name ResolutionProtocol DissectionChanging the DissectorViewing Dissector Source CodeFollowing StreamsFollowing SSL StreamsPacket LengthsGraphingViewing IO GraphsRound-Trip Time GraphingFlow GraphingExpert Information
Installing TSharkInstalling tcpdumpCapturing and Saving PacketsManipulating OutputName ResolutionApplying FiltersTime Display Formats in TSharkSummary Statistics in TSharkComparing TShark and tcpdump
Address Resolution Protocol (ARP)ARP Packet StructurePacket 1: ARP RequestPacket 2: ARP ResponseGratuitous ARPInternet Protocol (IP)Internet Protocol Version 4 (IPv4)Internet Protocol Version 6 (IPv6)Internet Control Message Protocol (ICMP)ICMP Packet StructureICMP Types and MessagesEcho Requests and ResponsestracerouteICMP Version 6 (ICMPv6)
Transmission Control Protocol (TCP)TCP Packet StructureTCP PortsThe TCP Three-Way HandshakeTCP TeardownTCP ResetsUser Datagram Protocol (UDP)UDP Packet Structure
Dynamic Host Configuration Protocol (DHCP)DHCP Packet StructureThe DHCP Initialization ProcessDHCP In-Lease RenewalDHCP Options and Message TypesDHCP Version 6 (DHCPv6)Domain Name System (DNS)DNS Packet StructureA Simple DNS QueryDNS Question TypesDNS RecursionDNS Zone TransfersHypertext Transfer Protocol (HTTP)Browsing with HTTPPosting Data with HTTPSimple Mail Transfer Protocol (SMTP)Sending and Receiving EmailTracking an Email MessageSending Attachments via SMTPFinal Thoughts
Missing Web ContentTapping into the WireAnalysisLessons LearnedUnresponsive Weather ServiceTapping into the WireAnalysisLessons LearnedNo Internet AccessGateway Configuration ProblemsUnwanted RedirectionUpstream ProblemsInconsistent PrinterTapping into the WireAnalysisLessons LearnedNo Branch Office ConnectivityTapping into the WireAnalysisLessons LearnedSoftware Data CorruptionTapping into the WireAnalysisLessons LearnedFinal Thoughts
TCP Error-Recovery FeaturesTCP RetransmissionsTCP Duplicate Acknowledgments and Fast RetransmissionsTCP Flow ControlAdjusting the Window SizeHalting Data Flow with a Zero Window NotificationThe TCP Sliding Window in PracticeLearning from TCP Error-Control and Flow-Control PacketsLocating the Source of High LatencyNormal CommunicationsSlow Communications: Wire LatencySlow Communications: Client LatencySlow Communications: Server LatencyLatency Locating FrameworkNetwork BaseliningSite BaselineHost BaselineApplication BaselineAdditional Notes on BaselinesFinal Thoughts
ReconnaissanceSYN ScanOperating System FingerprintingTraffic ManipulationARP Cache PoisoningSession HijackingMalwareOperation AuroraRemote-Access TrojanExploit Kit and RansomwareFinal Thoughts
Physical ConsiderationsSniffing One Channel at a TimeWireless Signal InterferenceDetecting and Analyzing Signal InterferenceWireless Card ModesSniffing Wirelessly in WindowsConfiguring AirPcapCapturing Traffic with AirPcapSniffing Wirelessly in Linux802.11 Packet StructureAdding Wireless-Specific Columns to the Packet List PaneWireless-Specific FiltersFiltering Traffic for a Specific BSS IDFiltering Specific Wireless Packet TypesFiltering a Specific FrequencySaving a Wireless ProfileWireless SecuritySuccessful WEP AuthenticationFailed WEP AuthenticationSuccessful WPA AuthenticationFailed WPA AuthenticationFinal Thoughts
Packet Analysis ToolsCloudSharkWireEditCain & AbelScapyTraceWranglerTcpreplayNetworkMinerCapTipperngreplibpcapNpcaphpingPythonPacket Analysis ResourcesWireshark’s Home PagePractical Packet Analysis Online CourseSANS’s Security Intrusion Detection In-Depth CourseChris Sanders’s BlogBrad Duncan’s Malware Traffic AnalysisIANA’s WebsiteW. Richard Stevens’s TCP/IP Illustrated SeriesThe TCP/IP Guide
Packet RepresentationUsing Packet DiagramsNavigating a Mystery PacketFinal Thoughts

Content preview from Practical Packet Analysis, 3rd Edition

DON’T JUST STARE AT CAPTURED PACKETS.ANALYZE THEM.

Download the capture files used in this book from nostarch.com/packetanalysis3/

It’s easy to capture packets with Wireshark, the world’s most popular network sniffer, whether off the wire or from the air. But how do you use those packets to understand what’s happening on your network?

Updated to cover Wireshark 2.x, the third edition of Practical Packet Analysis will teach you to make sense of your packet captures so that you can better troubleshoot network problems. You’ll find added coverage of IPv6 and SMTP, a new chapter on the powerful command line packet analyzers tcpdump and TShark, and an appendix on how to read and reference packet values using a packet map.

Practical Packet Analysis ...