The Network Security Test Lab: A Step-by-Step Guide

CHAPTER 3 Analyzing Network Traffic

This chapter takes an in-depth look at network traffic analysis. The packet analyzer is one of the key tools of any security professional. Not only is it an important tool, but it can also help you to understand how protocols work, to determine whether they pass information securely, and even to analyze malware. Still, the most important component of traffic analysis is understanding what all this data means. It is easy enough to install tcpdump, Snort, Wireshark, or any other traffic analysis tool, but how do you interpret all the data once you have captured it?

That is the purpose of this chapter. You will learn how to capture network traffic, which is not always easy. Sometimes you might be able to span a port, but not always; if you are unable to, don’t worry, because this chapter discusses some other options. This chapter will also look at the tools used to capture network traffic. As you might have guessed, one of the primary tools that will be reviewed is Wireshark.

Why Packet Analysis Is Important

All network problems can be traced down to the packet level. But it is not just that; packet analysis offers an understanding of how something really works. Think of it this way: say you liked old cars and you found a 1968 Camaro. You would not only want to look at the body but also under the hood. You would ask yourself things like whether it has the original interior, if the serial numbers match, does it have the original 327-horsepower ...