Practical packet analysis : using Wireshark to solve real-world network problems

BRIEF CONTENTS......Page 0
CONTENTS IN DETAIL......Page 3
1: Packet Analysis and Network Basics
......Page 9
Evaluating a Packet Sniffer......Page 10
How Packet Sniffers Work......Page 11
Protocols......Page 12
The Seven-Layer OSI Model......Page 13
Data Encapsulation......Page 16
Network Hardware......Page 18
Broadcast Traffic......Page 22
Unicast Traffic......Page 23
Final Thoughts......Page 24
2: Tapping into the Wire
......Page 25
Living Promiscuously......Page 26
Sniffing Around Hubs......Page 27
Sniffing in a Switched Environment......Page 28
Port Mirroring......Page 29
Hubbing Out......Page 30
Using a Tap......Page 32
ARP Cache Poisoning......Page 34
Sniffing in a Routed Environment......Page 38
Sniffer Placement in Practice......Page 39
A Brief History of Wireshark......Page 42
The Benefits of Wireshark......Page 43
Installing on Microsoft Windows Systems......Page 44
Installing on Linux Systems......Page 46
Installing on Mac OS X Systems......Page 47
Your First Packet Capture......Page 48
Wireshark’s Main Window......Page 49
Wireshark Preferences......Page 50
Packet Color Coding......Page 52
Working with Capture Files......Page 54
Saving and Exporting Capture Files......Page 55
Working with Packets......Page 56
Finding Packets......Page 57
Printing Packets......Page 58
Packet Time Referencing......Page 59
Capture Settings......Page 60
Capture File(s) Settings......Page 61
Stop Capture Settings......Page 62
Capture Filters......Page 63
Display Filters......Page 69
Saving Filters......Page 72
Network Endpoints and Conversations......Page 74
Viewing Endpoints......Page 75
Viewing Network Conversations......Page 76
Troubleshooting with the Endpoints and Conversations Windows......Page 77
Protocol Hierarchy Statistics......Page 78
Name Resolution......Page 79
Potential Drawbacks to Name Resolution......Page 80
Changing the Dissector......Page 81
Following TCP Streams......Page 83
Packet Lengths......Page 85
Viewing IO Graphs......Page 86
Round-Trip Time Graphing......Page 88
Expert Information......Page 89
6: Common Lower-Layer Protocols
......Page 92
Address Resolution Protocol......Page 93
The ARP Header......Page 94
Packet 1: ARP Request......Page 95
Gratuitous ARP......Page 96
IP Addresses......Page 98
The IPv4 Header......Page 99
Time to Live......Page 100
IP Fragmentation......Page 102
The TCP Header......Page 105
TCP Ports......Page 106
The TCP Three-Way Handshake......Page 108
TCP Teardown......Page 110
User Datagram Protocol......Page 112
The UDP Header......Page 113
ICMP Types and Messages......Page 114
Echo Requests and Responses......Page 115
Traceroute......Page 117
Dynamic Host Configuration Protocol......Page 120
The DHCP Packet Structure......Page 121
The DHCP Renewal Process......Page 122
DHCP In-Lease Renewal......Page 126
Domain Name System......Page 127
The DNS Packet Structure......Page 128
A Simple DNS Query......Page 129
DNS Recursion......Page 131
DNS Zone Transfers......Page 134
Browsing with HTTP......Page 136
Posting Data with HTTP......Page 138
Final Thoughts......Page 139
8: Basic Real-World Scenarios
......Page 140
Capturing Twitter Traffic......Page 141
Capturing Facebook Traffic......Page 144
Using the Conversations Window......Page 147
Using the Protocol Hierarchy Statistics Window......Page 148
Viewing DNS Traffic......Page 149
Viewing HTTP Requests......Page 150
No Internet Access: Configuration Problems......Page 151
No Internet Access: Unwanted Redirection......Page 154
No Internet Access: Upstream Problems......Page 157
Inconsistent Printer......Page 160
Stranded in a Branch Office......Page 162
Ticked-Off Developer......Page 166
Final Thoughts......Page 170
9: Fighting a Slow Network
......Page 171
TCP Retransmissions......Page 172
TCP Duplicate Acknowledgments and Fast Retransmissions......Page 175
TCP Flow Control......Page 179
Adjusting the Window Size......Page 180
The TCP Sliding Window in Practice......Page 181
Learning from TCP Error-Control and Flow-Control Packets......Page 184
Locating the Source of High Latency......Page 185
Slow Communications—Wire Latency......Page 186
Slow Communications—Client Latency......Page 187
Latency Locating Framework......Page 188
Network Baselining......Page 189
Site Baseline......Page 190
Host Baseline......Page 191
Additional Notes on Baselines......Page 192
Final Thoughts......Page 193
10: Packet Analysis for Security
......Page 194
SYN Scan......Page 195
Operating System Fingerprinting......Page 199
Operation Aurora......Page 202
ARP Cache Poisoning......Page 207
Remote-Access Trojan......Page 211
Final Thoughts......Page 218
11: Wireless Packet Analysis
......Page 219
Sniffing One Channel at a Time......Page 220
Detecting and Analyzing Signal Interference......Page 221
Wireless Card Modes......Page 222
Configuring AirPcap......Page 223
Capturing Traffic with AirPcap......Page 225
Sniffing Wirelessly in Linux......Page 226
802.11 Packet Structure......Page 227
Adding Wireless-Specific Columns to the Packet List Pane......Page 229
Filtering Traffic for a Specific BSS ID......Page 230
Filtering a Specific Frequency......Page 231
Wireless Security......Page 232
Successful WEP Authentication......Page 233
Failed WEP Authentication......Page 234
Successful WPA Authentication......Page 235
Failed WPA Authentication......Page 236
Final Thoughts......Page 237
tcpdump and Windump......Page 238
Netdude......Page 239
pcapr......Page 240
ngrep......Page 241
SANS Security Intrusion Detection In-Depth Course......Page 242
The TCP/IP Guide (No Starch Press)......Page 243