Wireshark Revealed: Essential Skills for IT Professionals

Chapter 7. Packet Analysis for Security Tasks

With the increasing threat of hackers, identity thieves, and corporate data theft, you need to be able to analyze the security of your network at the packet level.

The topics that will be covered in this chapter include:

• Security analysis methodology
• Scans and sweeps
• OS fingerprinting
• Malformed packets
• Phone home traffic
• Password cracking traffic
• Unusual traffic

Security analysis methodology

Security analysis at the packet level is based on detecting and analyzing suspect traffic, that is, the traffic that does not match normal patterns because of the presence of unusual protocol types or ports, or unusual requests, responses, or packet frequency. Suspicious traffic may include reconnaissance (discovery) sweeps, ...