Wireshark is one of the most robust and powerful open-source packet sniffers. It is both an interactive packet sniffing tool and analysis tool. It is the most popular packet sniffer currently, one of the reasons being it’s open-source availability and cross-platform compatibility. It can run on Windows, Linux and, Mac. User-friendly and easy to capture and view data because of the attractive graphical user interface.
Wireshark is one of the best tools for intercepting packets going across a target network, as well as read the contents of each packet in a human-readable format which can be filtered and colour-coded to meet specific requirements. It has a wide array of features which are mainly used to troubleshoot network problems and for analysis and testing of software.
Download and Install
As mentioned above, it is an open-source software, so it is available for download free of cost. You can download it for both Windows and MacOS from the official Wireshark website. For Linux or other UNIX-like systems, Wireshark is probably present in the package repositories. It comes pre-installed in the Kali Linux OS.
On launching the application, a welcome screen is visible which has the various network interfaces available for your device listed. In this case, we have Local Area Connection, Ethernet and Wi-fi. The small graph to the right of each represents the flow of live traffic on the interface.
The Main menu at the top displays the various options that Wireshark is equipped with, we’ll look at how to use the Capture, Analyze and Statistics choices.
Capture network packets
Network sniffing can be used to capture sensitive data like login credentials or to capture files sent over a network. Various protocols such as HTTP, Telnet, IMAP, FTP, SMTP among others are vulnerable to sniffing.
To begin capturing data, click on any one network interface which has some live transmission occurring. A drop-down menu will appear when you click on capture in the main menu, click on Start. To initiate capture with a keyboard, press CTRL+E.
The low-level packets transmitted over that particular network are now being live captured by Wireshark and can be seen in the default colour-coding.
To stop capturing, Capture->Stop or press CTRL+E
To know what protocol each colour implies to, go to View->Colouring Rules
You can also modify the code according to your preferences or turn off all colour coding.
Analyze captured content
When dealing with a heavy traffic network, the filtering capabilities of Wireshark come in handy. You can specify at the start to only capture certain types of packets or filter them out later. This can be done to a live capture as well as an already saved .pcapng file.
You can see the default filters by navigating to Analyze->Display FIlters
If you know the name of the filter you want to apply, start typing it in the ‘Apply a display filter’ field.It will turn green if your input is a valid field. You can add your filters to the bookmarks for future or repeated use, which can be found to the left of the input field.
Example: Applied a filter ‘icmpv6’ to captured packets
Now let’s look at a deeper analysis of individual packets
Each packet has timestamp and frame details, that is when was the packet created and in which frame exactly is it being transmitted. Other details include the source and destination address. Next come the individual protocol details, where their headers and payload portions are specified. One can get an idea about what all data is contained in this particular packet and which other packets are linked to this packet by looking at the data stored in the header. At the very bottom, the raw version of the same data is displayed in a hexadecimal view.
To bind all the extensive data and to see the captured packets from a bird’s eye view, statistics has several important tools which can be used to see file properties, protocol hierarchy or other statistics for individual protocols. Variety of charts and graphs are also available to see Transport protocol stream graphs or Input/Output data graph.
All these statistic data outputs can be saved and exported to several common file formats such as .txt, .xml and .csv
This tutorial barely scratched the surface of Wireshark.It is an extremely powerful tool which has additional advanced functionality such as the ability to write personalised protocol dissectors in Lua programming language.
Wireshark is the industry standard for network packet sniffing and analysis and every Security professional must be aware of what is going on with the network on which they work.