Could somebody explain the basics of Wireshark to me [closed]

Question

I've downloaded Wireshark, messed around with the GUI a bit and, honestly, I can't make head nor tail of what I am looking at.

I understand that Winpcap allows me to create a copy of every packet that travels down the wire on my local machine and then analyse this packet, and then wireshark shows me these packets graphically, and colour codes them based on type. I can then select a packet, and, in between all off the random letters and numbers, look for keywords such as usernames and passwords.

I also understand that I can apply filters so I can only view packets which match the specification for a particular protocol or which originate from a particular IP address.

That is everything I think I know about wireshark (most of which is probably wrong), could somebody explain what is going on in a bit more detail?

Thanks

Answer 1

Let's use a concrete HTTP example.

Let's say you are listening to an HTTP conversation between a client and server. When the client (in this case, cURL) sends to the server (in this case, localhost):

GET /index.html HTTP/1.1
User-Agent: curl/7.24.0 (i686-pc-cygwin) libcurl/7.24.0 OpenSSL/0.9.8t zlib/1.2.5 libidn/1.22 libssh2/1.3.0
Host: localhost
Accept: */*

This is sent down through the network stack before going out onto the wire. As you know, this isn't sent through in raw form. It has to be converted into the TCP/IP network protocol. That is, each piece of application data will be chopped into the appropriate number of IP packets, encapsulated with some TCP control information and sent to the destination. What you are seeing in the Wireshark UI are each of those TCP/IP packets. Wireshark decodes each packet with the appropriate protocol flags and options. Each packet further has a small piece of the HTTP application data.

So each TCP/IP packet will generally be broken into a stack that reads:

+ Frame
+ Ethernet II
+ Internet Protocol Version ...
+ Transmission Control Protocol ...
+ Hypertext Transfer Protocol

Each of those lines in Wireshark can open up to reveal the various flags, options and specific framing data associated with it. You can read about how Ethernet frames, IP packets (v4), and TCP packets are constructed in a variety of places online.

But the real interesting part from an application specific side is the HTTP payload. If you expand that section, you'll see parts of the data that was sent and/or received. You may not see the whole thing, because TCP packets can only contain so much data.

The beauty of Wireshark, in my opinion, is to be able to reconstruct the conversation in a more human readable format. If you locate the initial GET request from the client and right-click on it, you'll see an option to "Follow TCP Stream". This option will not only filter the network conversation to the appropriate packets, but will also generate nicely formatted human-readable text.

All of the other packets are completely dependent on what is going on in the network. They could be DNS requests/responses, TCP SYN/ACKs, network infrastructure traffic, broadcast packets, etc. You can quickly figure out what to ignore based on the "protocol" column as well as from the source and destination.

Answer 2

From the Wireshark documentation (the definitive document for this information):

• Available for UNIX and Windows.
• Capture live packet data from a network interface.
• Display packets with very detailed protocol information.
• Open and Save packet data captured.
• Import and Export packet data from and to a lot of other capture programs.
• Filter packets on many criteria.
• Search for packets on many criteria.
• Colorize packet display based on filters.
• Create various statistics.
• And much more

Significantly, you can use it to view an entire session between two machines - even if the network traffic includes that for many other destinations. This makes it very useful for first identifying some target traffic, then following that traffic to identify the endpoints, and then matching the key elements of that traffic in logs to track back attacks or long term issues.