Protocol analyzers are tools that we use to analyze the network traffic coming in and out of a specific
host computer.
Usually although not necessarily required.
The one we're sitting at at any given moment I never really liked the word protocol analyzer.
To me they're more like network analyzers or network traffic analyzers and these are critical tools
that any good I.T. security person should know extremely well.
Now the one I'm going to concentrate on today is the very very famous wireshark now wireshark has been
around for 20 years if not 20 close to it and has been a powerful go to tool for that entire time.
Wireshark is completely free and wireshark is specifically mentioned on the security plus.
So if we're talking about protocol analyzers we need to know about Wireshark.
Now before I start opening one up and letting you look at it you need to understand that there are two
very separate pieces to any protocol analyzer.
The first piece is what I'm going to call the sniffer.
The sniffer is some type of software and it's usually has a name like pre-cap like when Kapper and pre-cap
or 10 cap.
And these are tools that are actually grabbing all the data that's going in and out of a particular
interface.
And when I say grabbing all the data I mean all of the data so all the ethernet information all the
IP information all the application information it's all there.
And these tools grab it.
So a sniffer grabs all this information and then the sniffer is going to do one of two things.
It's either first going to save it into a file or it's going to make a live feed directly into the protocol
analyzer.
So the protocol analyzer really just reads pre-cap data and then and here's where the turn comes from
analyzes it in a way that we can look at it.
The best way to see this is to see it in action.
So let's fire up Wireshark.
So what I've done here is I just started wireshark for us and you'll see that on this particular system
it sees three different interfaces.
I want to keep it simple and just go to my ether net interface.
So I'm going to click on that and then I click on capture and let's start up.
I'll make a full screen as soon as it starts.
Great.
Now let's take a look at this.
So what's happening is in real time we are grabbing lots and lots of packets.
So what I'd like to do is I'm just going to scroll up and arbitrarily pick something you know I'm going
to stop it.
There we go.
So what I'm going to do is I'm going to pick one of these.
So what you're see right here is the 146 packet that it's picked up in this capture so far.
So when I click on this what we're looking at here at the bottom is the raw binary values in.
People don't use that very often so I'm going to scroll that down it's because this middle part is where
things are the most interesting.
So you'll notice when I clicked on is some kind of command Let's go down one more because that's an
app.
I know what that is.
I was there all the time.
OK.
So what you can do here is by clicking on these guys as you can get information.
So here's basically this is wireshark information.
When was this picked up how big is that stuff like that.
But the next one down is where things get interesting you notice it says Ethernet too.
So this is all layered to information so you'll see the destination source Mac addresses you'll see
what type of data it is in this case it's a simple arp.
And then we go into a little bit deeper and then we see the information that's being carried by an ARP.
Now if you're not familiar with ARP ARP is designed.
If somebody asks what an IP address is whatever device with that IP address responds back with its MAC
address.
So ARP resolves IP addresses to mac address.
So knowing that if we take a look in here we can see what it's saying is here's my IP address here's
the Mac Here's my IP address and then here's the Mac.
So this is a perfect example of a ARP taking place without us having to do much.
Now the downside to all of this is that you get tremendous amounts of information.
So what I'm going to do is I'm going to start another capturer it's asking if I want to save that I'm
going to say no and I'm going to sit here and let it capture for a while.
So at this point it's going to start grabbing a tremendous amount of data.
And the challenge we're going to run into is trying to find what data is what.
So let's just let it run for a little bit so you can see now I'm up to seven thousand different packets
so there's a lot of information in here.
And what I want to be able to do and this is a really powerful feature of wireshark is the ability to
filter data.
So when I want to do is go through and let's look for some certain things for example one of the things
I'd like to find is has there been any DHC traffic going on.
So what I'm going to do is way up here in left hand corner I'm going to type in and you'll notice he's
trying to help me here.
The HTP uses the term boot P and what I'm gonna do is I'm going to say filter out everything out of
this capture with the exception of DHP traffic and you'll see now that I filtered all this out.
You can see I've got two different CPS in there I've got one DHP that released itself and then another
DHC that came in and re established itself.
Yes I did that myself.
But I want you to be able to understand that the real power of Wireshark and this is absolutely amazing
is the way wireshark can filter information.
So let's do this again except this time when I want to do is I just want to look at HTP graphic.
So now in this case you'll see I've just got HTP information.
So what I want is just looking at HTP doesn't do me much good.
But what I can do this is another great feature is that wireshark is smart about oh here's one particular
session going on and this I could have four or five web browsers open right now so I can't filter this
out but we're instead going to see if wireshark can.
So what I'm going to do is I'm just going to arbitrarily click on any one of these and I'm going to
go down to follow TCAP stream.
So what you're looking at now is actually the entire web page for that one particular HTP session that
came in.
Now I don't necessarily know exactly what this is.
If I look a little bit it looks like a J page.
Image was brought down so if I was really interested I could probably just grab all this I can look
at the X I-F data for that jpeg.
So there's a lot of scenarios where I can do some real R&D in terms of what's taking place on any particular
session using Wireshark.
Now that's all I want to do and Wireshark.
Now I need to stress to you more than anything else is that wireshark is an incredibly incredibly powerful
tool if you're looking for.
For example what if I was looking for a rogue DHC P server in that particular case I could just look
for boops information and suddenly I've got another mac address for something that isn't my DHC server.
Wireshark would be an instant way to know that you've got a rogue DHC server.
What if I had art poisoning going on instead of just a few ARP commands.
What if I was getting zillions of them and doing strange ARP commands like router redirects and stuff
like that which is pretty nonstandard.
I can just do a quick filter on arp.
I can see all those and I can very quickly ascertain the fact that I've probably got an art poisoner
out on my network someplace.
The last place where wireshark is really handy stuff for example like a broadcast storm.
What if one person's Nic in the network just breaks and starts sending out all kinds of arbitrary garbage
traffic.
Well again with a tool like wireshark I could just filter on a particular IP address or even the MAC
address of the suspect Nic and get all of this ugly information.
Yeah I wouldn't be able to read it but I would certainly know that that particular system with that
particular IP address and that particular Mac is sending out bad information at the very least I can
zero in on that system and do some diagnosis.
So there's tons of places where this really really comes into play if you want to learn about Wireshark.
There are books out there that are this thick and they're actually interesting reading in terms of the
power of what wireshark can actually provide.
Hopefully I've got you a little bit interested and you'll take a deeper.
This is about as far as security plus goes.
The one downside to wireshark is that wireshark by itself has great protocol analyzing tools but a lot
of the ways it works is that sometimes it misses a lot of incoming and outgoing packets.
Now for casual users like me it's not that big of a deal.
But for some people it's incredibly irritating.
So what they'll do is instead of using the sniffers that come with wireshark they're going to use other
tools and probably one of the most famous is TZP dump which runs only on Linux.
Let me show that to you.
OK so here I am in my Ubuntu system and I'm going to do a quick run of TC PDA.
So I'm just going to do a Sudoku TZP dump.
And I want you to watch this.
This looks very similar to what we were seeing earlier with wireshark TCAP dump is not really a protocol
analyzer although it has some basic tools.
What TCAP done does much better than the wireshark does is sniff.
It's real Slinn it works real well and it is very rare that this particular tool will miss even a single
packet coming in or out of a particular host.
So when it comes to looking for very specific scenarios on your network things like Rodi HGP servers
aren't poisoning being able to read incoming and outgoing HTP or S-sh or anything type packets your
goto tool is going to be a protocol analyzer and my go to tool is wireshark on
and
on
and.