1. An Introduction to Protocol Analysis

2. INTRODUCTIONS

3. Gerald Combs
 Author
 Founder
 Developer
 Community Leader

4. Cace Technologies
 Where Gerald Works (for now)
 Home of AirPcap
 For wireless captures of 802.11 frames
 TurboCap
 Wireshark Appliances
 Pilot Reporting Software

5. PILOT

6. Laura Chappell
 Where to begin
 Is an independent
 Runs
 Wireshark University
 Chappell University
 Heads up Wireshark
Certification

7. Wireshark University
 Training Materials
 Videos
 Captures
 Books
 CD/DVD

8. Other Tools
 T Shark  TCPDump
 Included with wireshark  Native to *nix
 Netmonitor  Windows version
 Capsa  Snoop
 Cain  Sun Microsystems
 Windump  Ettercap
 Dsniff
 Ngrep

9. OVERVIEW

10. Purpose
 Troubleshooting
 Slow Networks
 Application Problems
 DNS Issues
 Web Servers
 DHCP Issues

11. Review of OSI
 Layer 7 Application (Net Process to App)
 Layer 6 Presentation (Data Rep. & Encrypt)
 Layer 5 Session (Interhost Comm)
 Layer 4 Transport (Delivery Protocol)
 Layer 3 Network (Logical Addressing)
 Layer 2 Data Link (Physical Addressing)
• MAC
• LLC
 Layer 1 Physical (Media, signal & Bin)

12. Review of OSI
 Layer 8 Politics & Money

13. Review of Ethernet

14. Ethernet Frame Structure

15. Review of IP

16. IP Packet Structure

17. Review of TCP

18. TCP Segment Structure

19. Review of TCP/IP
 TCP  IP
 Layer 4 Transport  Layer 3 Logical
 RES/NONCE/CWR/ECHO Addressing Protocol
 URG/ACK/PSH/RST/SYN/ (10.1.0.22/24)
FIN
 Connection Oriented
 UDP
 Layer 4 Transport
Protocol
 Connectionless

20. TCP Flags
• Special Flags (first one reserved)
• NS = Nonce Sum
• CWR = Congestion Window Reduced
• ECE = ECN-Echo
• URG = Urgent
• ACK = Acknowledgement
• PSH = Push
• RST = Reset
• SYN = Synchronize
• FIN = Finish

21. See Appendix A

23. Basic Network Applications
 FTP - TCP  SIP – TCP/UDP
 Ports 20 & 21  Port 5060
 Telnet - TCP  SQL - TCP
 Port 23  Port 1433
 SMTP - TCP  RDP - TCP
 Port 25  Port 3389
 DNS - UDP  PPTP - TCP
 Port 53  1723 & 1725
 HTTP - TCP  Syslog – UDP
 Port 80  Port 514

24. TCP HADNSHAKE

25. DATA TRANSFER

26. SESSION CLOSURE

27. LAB/BREAK

28. A Guided Tour

29. Profiles

30. Preferences

31. DIRECTORY STRUCTURE

32. Personal Settings
 C:users<username>AppDataRoamingWireshark
profiles
 Profiles
 cfilters
 preferences

33. System Settings
 C:program fileswireshark
 Dfilters – display filters
 Dumpcap - program
 Editcap – edit .pcap files
 Mergecap – merge .pcap files
 Rawshark – capture in “raw” format
 Text2pcap – conversion tool
 Tshark – cli version of wireshark
 Colorfilters (don’t touch!)

34. Ring Buffers
 What are they  Configuring
 Where are they stored  Single/multiple
 Why are they useful  What size
 How often
 How many
 Stopping

35. Selecting an Interface
 Preferences  Manually

36. Saving Files
 Where?
 How big?
 How many?
 What format?
 Speed to disk

37. Placement
 Hubbing Out -> Easy but loss of data
 Port Spanning -> Good on less busy net
 In Line Taps -> Best but pricey

38. CAPTURES
Get as close as possible!

39. Captures
 Where to store them
 How much space do they
take up
 How to store them

40. Display Filters
 Not my MAC

41. Capture Filters
 Not my MAC

42. Colorizing
 Built in scheme
 Change on the fly

43. LAB 1

44. LAB 2

45. LAB 3

46. LAB 4

47. LAB 5

48. Statistics and Reporting

49.  Statistics  Advanced Statistics
 Conversations  Conversation lists
 Endpoints
 IP Addresses
 IP Endpoints
 IP Protocol Types
 UDP Multicast Streams
WLAN Traffic

50. RESOURCES
 www.wireshark.org  Wireshark
 www.cacetech.com  Wireshark Certification
 www.chappellseminars.c Guide
om  Wireshark Certification
 www.wiresharkuniversity Exm Prep Guide
.com

51. STAY SECURE!