Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems

284 Pages·2011·27.397 MB·English

by  Sanders, Chris

E 2
D N
DDOONN’’TT JJUUSSTT SSTTAARREE IT D
PPRR AACCTTIICCAALL I
AATT CCAAPPTTUURREEDD Download the capture files O
N
used in this book from
PPAACCKKEETTSS.. E
http://nostarch.com/packet2.htm D
AANNAALLYYZZEE TTHHEEMM.. IT2N PPAACCKKEE TT AANNAALLYYSSIISS
ID
O
N
U S I N G W I R E S H A R K T O S O L V E R E A L - W O R L D
PP
N E T W O R K P R O B L E M S
RR
It’s easy to capture packets with Wireshark, the world’s • Graph traffic patterns to visualize the data flowing
most popular network sniffer, whether off the wire or from across your network AA
the air. But how do you use those packets to understand CC
• Use advanced Wireshark features to understand C H R I S S A N D E R S
what’s happening on your network?
confusing captures TT
With an expanded discussion of network protocols and 45 II
• Build statistics and reports to help you better explain CC
completely new scenarios, this extensively revised second
technical network information to non-techies
edition of the best-selling Practical Packet Analysis will AA
teach you how to make sense of your PCAP data. You’ll Practical Packet Analysis is a must for any network LL
find new sections on troubleshooting slow networks and technician, administrator, or engineer. Stop guessing and
PP
packet analysis for security to help you better understand start troubleshooting the problems on your network.
how modern exploits and malware behave at the packet AA
ABOUT THE AUTHOR
level. Add to this a thorough introduction to the TCP/IP CC
network stack and you’re on your way to packet analysis Chris Sanders is a computer security consultant, author, KK
proficiency. and researcher. A SANS Mentor who holds several
EE
industry certifications, including CISSP, GCIA, GCIH, and
Learn how to: TT
GREM, he writes regularly for WindowSecurity.com and

• Use packet analysis to identify and resolve common his blog, ChrisSanders.org. Sanders uses Wireshark daily AA
network problems like loss of connectivity, DNS issues, for packet analysis. He lives in Charleston, South Carolina,
NN
sluggish speeds, and malware infections where he works as a government defense contractor.
AA
• Build customized capture and display filters
All of the author’s royalties from this book LL
• Monitor your network in real-time and tap live will be donated to the Rural Technology Fund YY
network communications (http://ruraltechfund.org). SS
II
SS
THE FINEST IN GEEK ENTERTAINMENT™
S
www.nostarch.com A
N
D
$49.95 ($57.95 CDN) ER
T his b o o k u“sIe sL aI Ela yF-LflAaTt .b”inding that won’t snap shut. NETWORKINSHELVE IN: S
FSC LOGO G/SECURITY

PRAISE FOR THE FIRST EDITION OF
PRACTICAL PACKET ANALYSIS
“An essential book if you are responsible for network
administration on any level.”
—LINUX PRO MAGAZINE
“A wonderful, simple to use and well laid out guide.”
—ARSGEEK.COM
“If you need to get the basics of packet analysis down pat, this is
a very good place to start.”
—STATEOFSECURITY.COM
“Very informative and held up to the key word in its title,
‘Practical.’ It does a great job of giving readers what they need
to know to do packet analysis and then jumps right in with vivid
real life examples of what to do with Wireshark.”
—LINUXSECURITY.COM
“Are there unknown hosts chatting away with each other? Is my
machine talking to strangers? You need a packet sniffer to really
find the answers to these questions. Wireshark is one of the best
tools to do this job and this book is one of the best ways to learn
about that tool.”
—FREE SOFTWARE MAGAZINE
“Perfect for the beginner to intermediate.”
—DAEMON NEWS

PRACTICAL PACKET
ANALYSIS
2 N D E D I T I O N
Using Wireshark to Solve
Real-World Network
Problems
by Chris Sanders
San Francisco
PRACTICAL PACKET ANALYSIS, 2ND EDITION. Copyright © 2011 by Chris Sanders.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior
written permission of the copyright owner and the publisher.
Printed in Canada
15 14 13 12 11 1 2 3 4 5 6 7 8 9
ISBN-10: 1-59327-266-9
ISBN-13: 978-1-59327-266-1
Publisher: William Pollock
Production Editor: Alison Law
Cover and Interior Design: Octopod Studios
Developmental Editor: William Pollock
Technical Reviewer: Tyler Reguly
Copyeditor: Marilyn Smith
Compositor: Susan Glinert Stevens
Proofreader: Ward Webber
Indexer: Nancy Guenther
For information on book distributors or translations, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
38 Ringold Street, San Francisco, CA 94103
phone: [phone]; fax: [phone]; [email protected]; www.nostarch.com
The Library of Congress has cataloged the first edition as follows:
Sanders, Chris, 1986-
Practical packet analysis : using Wireshark to solve real-world network problems / Chris Sanders.
p. cm.
ISBN-13: 978-1-59327-149-7
ISBN-10: 1-59327-149-2
1. Computer network protocols. 2. Packet switching (Data transmission) I. Title.
TK5105.55.S265 2007
004.6'6--dc22
2007013453
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and
company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark
symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the
benefit of the trademark owner, with no intention of infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been
taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any
person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the
information contained in it.
This book, my life, and everything I will ever do is a direct result of faith
given and faith received. This book is dedicated to God, my parents, and
everyone who has ever shown faith in me.
I tell you the truth, if you have faith as small as a mustard seed, you
can say to this mountain, “Move from here to there” and it will
move. Nothing will be impossible for you.
Matthew 17:20

B R I E F C O N T E N T S
Acknowledgments .........................................................................................................xv
Introduction ................................................................................................................xvii
Chapter 1: Packet Analysis and Network Basics ................................................................1
Chapter 2: Tapping into the Wire ..................................................................................17
Chapter 3: Introduction to Wireshark ..............................................................................35
Chapter 4: Working with Captured Packets .....................................................................47
Chapter 5: Advanced Wireshark Features .......................................................................67
Chapter 6: Common Lower-Layer Protocols ......................................................................85
Chapter 7: Common Upper-Layer Protocols ...................................................................113
Chapter 8: Basic Real-World Scenarios ........................................................................133
Chapter 9: Fighting a Slow Network ............................................................................165
Chapter 10: Packet Analysis for Security .......................................................................189
Chapter 11: Wireless Packet Analysis ..........................................................................215
Appendix: Further Reading ..........................................................................................235
Index.........................................................................................................................241