- Protocol analyzers are tools that we use
to analyze the network traffic coming in
and out of a specific host computer.
Usually, although not necessarily required,
the one we're sitting at at any given moment.
I never really liked the word protocol analyzer.
To me, they're more like network analyzers
or network traffic analyzers
and these are critical tools
that any good IT security person should know extremely well.
Now the one I'm gonna concentrate on today is the very,
very famous Wireshark.
Now, Wireshark has been around for 20 years,
if not 20, close to it
and has been a powerful go-to tool for that entire time,
Wireshark is completely free.
So if we're talking about protocol analyzers,
we need to know about Wireshark.
Now, before I start opening one up
and letting you look at it,
you need to understand that there are two
very separate pieces to any protocol analyzer.
The first piece is what I'm gonna call the sniffer.
The sniffer is some type of software and it's,
usually has a name like Pcap,
like WinPcap or NPcap or Win10Pcap.
And these are tools that are actually grabbing all the data
that's going in and out of a particular interface.
And when I say grabbing all the data,
I mean all of the data.
So all the ethernet information,
all the IP information, all the application information,
it's all there and these tools grab it.
So a sniffer grabs all this information
and then the sniffer's gonna do one of two things.
It's either, first, gonna save it into a file
or it's going to make a live feed
directly into the protocol analyzer.
So the protocol analyzer really just reads Pcap data
and then, and here's where the term comes from,
analyzes it in a way that we can look at it.
The best way to see this is to see it in action.
So let's fire up Wireshark.
So what I've done here is
I've just started Wireshark up for us
and you'll see that on this particular system,
it's these three different interfaces.
I wanna keep it simple and just go to my ethernet interface.
So I'm gonna click on that and then I click on capture
and let's start her up.
I'll make it full screen as soon as it starts.
Great.
Now let's take a look at this.
So what's happening is in real time,
we are grabbing lots and lots of packets.
So what I'd like to do is,
I'm just gonna scroll up.
And arbitrarily pick something.
You know what?
I'm gonna stop it, there we go.
So what I'm gonna do is, I'm gonna pick one of these.
So what you're seeing right here is the 146th packet
that it's picked up in this capture so far.
So when I click on this,
what we're looking at here at the bottom is the raw,
binary values in hex.
People don't use that very often
so I'm gonna scroll that down.
It's because this middle part
is where things are the most interesting.
So you'll notice what I've clicked on
is some kind of command, let's go down one more
'cause that's an ARP, I know that is.
Oops.
Oh, it was there all the time.
Okay, so what you can do here is,
by clicking on these guys, is you can get information.
So here's basically, this is Wireshark information.
When was this picked up?
How big is it?
Stuff like that.
But the next one down is where things get interesting.
You'll notice it says ethernet two.
So this is all layer two information.
So you'll see the destination and source MAC addresses.
You'll see what type of data it is,
in this case it's a simple ARP.
And then we go in a little bit deeper
and then we see the information that's being carried
by an ARP.
Now, if you're not familiar with ARP,
ARP is designed, if somebody asks what an IP address is,
whatever device with that IP address
responds back with its MAC address.
So ARP resolves IP addresses to MAC addresses.
So knowing that if we take a look in here,
we can see what it's saying is,
here's my IP address, here's the MAC, here's my IP address
and then here's the MAC.
So this is a perfect example of a ARP taking place
without us having to do much.
Now, the downside to all this
is that you get tremendous amounts of information.
So what I'm gonna do is I'm gonna start another capture.
It's asking if I wanna save that, I'm gonna say no.
And I'm gonna sit here and let it capture for awhile.
So at this point,
it's gonna start grabbing a tremendous amount of data.
And the challenge we're gonna run into
is trying to find what data is what.
So let's just let it run for a little bit.
Then you can see, now I'm up to 7,000 different packets.
So there's a lot of information in here
and what I wanna be able to do
and this is a really powerful feature of Wireshark
is the ability to filter data.
So what I wanna do is go through
and let's look for some certain things.
For example, one of the things I'd like to find is
has there been any DHCP traffic going on?
So what I'm gonna do is,
way up here in the left-hand corner, I'm gonna type in,
and the, you'll notice he's trying to help me here.
DHCP uses the term BOOTP
and what I'm gonna do is I'm gonna say,
filter out everything out of this capture
with the exception of DHCP traffic.
And you'll see, now that I filtered all this out,
you can see that I've got two different DHCPs in there.
I've got one DHCP that released itself
and then another DHCP that came in
and re-established itself.
Yes, I did that myself
but I want you to be able to understand that
the real power of Wireshark
and this is absolutely amazing,
is the way Wireshark can filter information.
So let's do this again.
Except this time what I wanna do,
is I just wanna look at HTTP traffic.
So now, in this case you'll see,
I've just got HTTP information.
So what I want is,
just looking at HTTP doesn't do me much good,
but what I can do and this is another great feature,
is that Wireshark is smart about, oh,
here's one particular session going on and this,
I could have four or five web browsers open right now.
So I can't filter this out
but we're instead gonna see if Wireshark can.
So what I'm gonna do is,
I'm just gonna arbitrarily click on any one of these
and I'm gonna go down to follow, TCP stream.
So what you're looking at now is actually the entire webpage
for that one particular HTTP session that came in.
Now, I don't necessarily know exactly what this is.
If I look a little bit,
it looks like a JPEG image was brought down.
So if I was really interested,
I could probably just grab all this.
I can look at the EXIF data for that JPEG.
So there's a lot of scenarios
where I can do some real R and D
in terms of what's taking place on any particular session
using Wireshark.
Now, that's all I wanna do on Wireshark.
Now I need to stress to you more than anything else,
is that Wireshark is an incredibly,
incredibly powerful tool.
If you're looking for, for example,
what if I was looking for a rogue DHCP server?
In that particular case,
I could just look for BOOTP information
and suddenly I've got another MAC address
for something that isn't my DHCP server.
Wireshark would be an instant way to know
that you've got a rogue DHCP server.
What if I had ARP poisoning going on?
Instead of just a few ARP commands,
what if I was getting zillions of them
and doing strange ARP commands like router redirects
and stuff like that, which is pretty non-standard.
I can just do a quick filter on ARP, I can see all those,
and I can very quickly ascertain the fact that
I've probably got an ARP poisoner
out on my network someplace.
The last place where Wireshark is really handy is stuff,
for example, like a broadcast storm.
What if one person's NIC in the network just breaks
and it starts sending out all kinds of arbitrary,
garbage traffic?
Well, again, with a tool like Wireshark,
I could just filter on a particular IP address
or even the MAC address of the suspect NIC
and get all of this ugly information.
Yeah, I wouldn't be able to read it,
but I would certainly know that that particular system
with that particular IP address in that particular MAC
is sending out bad information.
At the very least, I could zero in on that system
and do some diagnosis.
So there's tons of places where this really,
really comes into play.
If you wanna learn about Wireshark,
there are books out there that are this thick
and they're actually interesting reading
in terms of the power of what Wireshark
can actually provide.
Hopefully I've got you a little bit interested
and you'll take it deeper.
The one downside to Wireshark is that Wireshark by itself
has great protocol analyzing tools,
but a lot of the ways it works is that sometimes
it misses a lot of incoming and outgoing packets.
Now, for casual users like me, it's not big of a,
that big of a deal,
but for some people it's incredibly irritating.
So what they'll do is,
instead of using the sniffers that come with Wireshark,
they're gonna use other tools
and probably one of the most famous is tcpdump,
which runs only on Linux, let me show that to you.
Okay, so here I am in my Ubuntu system
and I'm gonna do a quick run of tcpdump.
So I'm just gonna do a sudo tcpdump.
And I want you to watch this.
This looks very similar to what we were seeing earlier
with Wireshark.
Tcpdump is not really a protocol analyzer,
although it has some basic tools.
What TCP dump does much better than the Wireshark does
is sniff, it's real slim, it works real well
and it is very rare that this particular tool
will miss even a single packet coming in
or out of a particular host.
So when it comes to looking for very specific scenarios
on your network, things like rogue DHCP servers,
ARP poisoning, being able to read incoming
and outgoing HTTP or SSH or anything type packets,
your go-to tool is going to be a protocol analyzer
and my go-to tool is Wireshark.