NETWORK PACKET ANALYSIS (Wireshark)Introduction to Wireshark and Its Importance in Cybersecurity Wireshark is a widely used network protocol analyzer that allows security professionals, system administrators, and network engineers to capture and inspect traffic in real time. It provides a detailed view of network communications, helping users analyze packets at a granular level. Why Wireshark is Used in Cybersecurity? Network Traffic Analysis 1. Helps monitor and analyze real-time data transmission across a network. 2. Identifies unusual traffic patterns that could indicate a cyber attack. Intrusion Detection and Threat Hunting 1. Detects signs of malicious activity, such as unauthorized access or malware communication, 2, Assists in tracking down the source of am attack by analyzing traffic behavior. Packet Inspection and Forensics 1. Examines network packets to identify malware-infeeted data or suspicious payloads. 2. Helps in post-incident investigations to understand how a breach occurred Performance Monitoring and Troubleshooting |. Identifies network congestion, dropped packets, and misconfigurations affecting performance. 2. Troubleshoots network latency and connectivity issues efficiently. Penetration Testing and Ethical Hacking L._ Used to analyze vulnerabilities in network security protocols. 2. Helps ethical hackers understand how attackers can intereept and manipulate network traffic. Decrypting Enerypted Traffic (When applicable) 1. Allows inspection of unencrypted and weakly encrypted data. 2._Aids in ensuring sensitive information is nat exposed over the network Wireshark is an essential tool in eybersecurity defense, providing visibility into network traffic to identify vulnerabilities, detect attacks, and enhance overall security. Export Objects (Files) Wireshark can extract files transferred through the wire. For a security analyst, it is vital to discover shared files and save them for further investigation. Exporting objects are available only for selected protocol's streams (DICOM, HTTP, IMF, SMB and TFTP).‘Time Display Format Wireshark lists the packets as they are captured, so investigating the default flow is not always the best option. By default, Wireshark shows the time in "Seconds Since Beginning of Capture”, the common usage is using the UTC Time Display Format for a better view. You can use the "View > Time Display Format” menu to change the time display formatoe eae 4 feet ee Sarna ire on Toor TOT pe Expert Info Wireshark also detects specific states of protocols to help analysts easily spot possible anomalies and problems. Note that these are only suggestions, and there is always a chance of having false positives/negatives. Expert info can provide a group of categories are shown in the table below. three different severities. Details Severity Colour Info Chat Blue Information on usval workflow. Note Cyan Notable events like application enor codes Warn Yellow ‘Warnings like unusual esror codes or problem statements Error Red Problems like malformed packetsFrequently encountered information groups ate listed in the table below. You can refer to Wireshark's official documentation for more information on the expert information entries. Group Info Group Info Checksum Checksum errors Deprecated Deprecated protocol usage. Packet comment Malformed pack Comment - Malformed pale detection, detection. Cietneyae Sees aoe = Apply as Filter This is the most basic way of filtering traffic, While investigating a capture file, you can click on the field you want to filter and use the "right-click menu” or "Analyse —> Apply as Filter" menu to filter the speci value. Once you apply the filter, Wireshark will generate the required filter query, apply it, show the packets according to your choice, and hide the unselected packets from the packct list pane. Note that the number of total and displayed packets are always shown on the status bar.Conversation filter + "Conversation Filter" option helps you view only the related packets and hide the rest of the packets easily. You can use the"right-click menu” or "Analyse - -> Conversation Filter" menu to filter conversations. Colourise Conversation + This option is similar to the "Conversation Filter" with one difference. It highlights the linked packets without applying a display filter and decreasing the number of viewed packets. This option works with the "Colouring Rules" option ad changes the packet colours without considering the previously applied colour rule. You can use the "right-click menu" or "View --> Colourise Conversation" menu to coloutise a linked pecket in a single click. Note that you ean use the "View --> Colourise Conversation —> Reset Colourisation” menu to undo this operation.Prepare as Filter Similar to "Apply as Filter", this option helps analysts create display filters using the "right-click" menu. However, unlike the previous one, this model doesn't apply the filters after the choice. It adds the required query to the pane and waits for the execution command (entet) or another chosen filtering, option by using the ".. and/or." from the “right-click menu"iB 35 He the 8; iii i serene i y cri iu o> armies i 3) PeeT TETAS tes 1290) comme pre own} Apply as Column By default, the packet list pane provides basic information about each packet. You can use the ight-click menu!" or "Analyse > Apply as Column” menu to add columns to the packet list pane. Once you click on a value and apply it as a column, it will be visible on the packet list pane. This function helps analysts examine the appearance of a specific value/field across the available packets in the capture file. You can enable/disable the columns shown in the packet list pane by clicking on the top of the packet fist pane.Follow Stream Wireshark displays everything in packet portion size. However, itis possible to reconstruct the streams and view the raw traffic as it is presented at the application level. Following the protocol, streams help analysts recreate the application-level data and understand the event of interest, It is also possible to view the unencrypted. protocol data like usernames, passwords and other transferred data, You can use the"rightclick menu" or "Analyse —> Follow TCP/UDP/HTTP Stream" menu to follow traffic streams, Streams are shown in a separate dialogue box; packets originating from the server are highlighted with blue, and those originating from the client are highlighted with red. ‘Once you follow a stream, Wireshark automatically creates and applies the required filter to view the specific stream, Remember, once a filter is applied, the number of the viewed packets will change. You will need to use the "X button" located on the tight upper side of the display filter bar to remove the display filter and view all available packets in the capture file. Statistics + This menu provides multiple statistics options ready to investigate to help users see the big picture in terms of the scope of the traffic, available protocols, endpoints and conversations, and some protocol-specific details like DHCP, DNS and HTTP/2. For a security analyst, it is crucial to know how to utilise the statical information. This section provides a quick summary of the processed peap, which will help analysts create a hypothesis for an investigation, You can use the "Statistics" menu to view all availableoptions. Now start the given VM, open the Wireshark, load the "Exercise peapng" file and go through the walkthrough. Resolved Addresses This option helps analysts identify TP addresses and DNS names available in the capture file by providing the list of the resolved addresses and their hostnames. Note that the hostname information is, taken from DNS answers in the capture file. Analysts can quickly identify the accessed resources by using this menu, ‘Thus they can spot accessed resources and evaluate them according to the event of interest. You can use the "Statistics —> Resolved Addresses" menu to view all resolved addresses by Wireshark Tas] pots | capture le cmments oe vss foe feeaazas.te8 ‘pies map faslynet onwoam saa lrsaassese [Link] —_ braasess 10s pened avi atrsnt = lber2o208123 ro ngston 96 pro datos na ‘ce lcazeains betcha ewe com awe f2sos.sre0.3037=001s:4Fed werwcbemyravelmuse com pei [2s08-4700:3030:2043:9307 row bemyrravelmuse com =, Jesasazzrane vor [Link] I sats 741374205 won [Link] Protocol Hierarchy This option breaks down all available protocols from the capture file and helps analysts view the protocols in a tree view based on packet coumiers and perventages. Thus analysts can view the overall usage of the ports and services and focus on the event of interest. The golden rule mentioned in the previous oom is valid in this section: you can right-click and filter the event of interest. You can use the "Statistics -> Protocol Hierarchy" meau to view this info. 10scnsesnsestecesneeetg Conversations Conversation represents traffic between two specific endpoints. This option provides the list of the conversations in five base formats; ethemet, IPv4, IPv6, TCP and UDP. Thus analysts can identify all conversations and contact endpoints for the event of interest. You can use the "Statistic —> Conversations" menu to view this info. “ae reas = = ea —e = = aad Endpoints The endpoints option is similar to the conversations option. The only difference is that this option provides unique information for a single information field (Ethernet, IPv4, IPv6, TCP and UDP ). Thus analysts can identify the unique endpoints in the capture file and use it for the event of interest. You can use the "Statistics > Endpoints" menu to view this info Wireshark also supports resolving MAC addresses to human-readable format using the manufacturer name assigned by IEEE. Note that this conversion is done through the first three bytes of the MAC address and only works for the known manufacturers, When you review the ethemet endpoints, you ean activate this option with the "Name resolution button in the lower-left comer of the endpoints window. 12Name resolution is not limited only to MAC addresses. Wireshark provides IP and port name resolution options as well. However, these options are not enabled by default, jes, you need to activate them through the "Edit —> If you want to use these functional Preferences > Name Resolution" menu. Once you enable IP and port name resolution, you will see the resolved IP address and port names in the packet list pane and also will be able to view resolved names in the "Conversations" and "Endpoints" menus as well, 13ie cee doe ga 2-0,911310 39.911310 148.284. 160.237 65 49.911310 145.254, 160.237 65 51,472116 [Link] 145, 20.911310 SSSR PRIN cialan-149-252-10.. Tor ‘oz etna) ~ cap 301911810 dialin-145-25. [Link]. Te? 5 Lip2(3872) = http(80) [ACK] 40.911310 dialin-146-25,. [Link] HTTP 1533 GET /download, Atal MTTP/1.1 5.1,472116 [Link] dialin.145.284-16__ TCP. ‘Se hetp(aa) —- tipeC3az2) (ACK Endpoint menu view with name resolution: vastestelitiva Besides name resolution, Wireshark also provides an IP geolocation mapping that helps analysts identify the map's source and destination 14addresses. But this feature is not activated by default and needs supplementary data like the GeolP database. Currently, Wireshark supports MaxMind databases, and the latest versions of the Wireshark come configured MaxMind DB resolver, However, you still need MaxMind DB files and provide the database path to Wireshark by = Name Resolution > MaxMind database directories” menu. using the "Edit -> Preferences Once you download and indicate the path, Wireshark will automatically provide GeolP information under the IP protocol details for the matched IP addresses. Be EN wer Go gotwe guys Bah Tome wees Tels Ey anc Re es S585 88552 an ty aan 8) CN ne AE 15Up to here, almost all options provided information that contained both versions of the IP addresses. The statistics menu has two options for narrowing the statistics on packets containing a specific IP version. Thus, analysts can identify and list all events linked to specific IP versions in a single window and use it for the event of interest. You can use the "Statistics > IPVX Statistics" menu to view this info. EREEARRERSERERESIORS ibaa aii TAI a8 il na Eg r aaaauaHHTH TTT Hy DNS ‘This option breaks down all DNS packets from the capture file and helps analysts view the findings in a tree view based on packet counters and percentages of the DNS protocol. Thus analysts can view the DNS service's overall usage, including reode, opcode, class, query type, service and query stats and use it for the event of interest. You can use the "Statisties > DNS" menu to view this info, 16.epten, aires foot a frre vee sensei ‘er noms HTTP This option breaks down all HTTP packets from the capture file and helps analysts view the findings in a tree view based on packet counters and pereentages of the HTTP protocol. Thus analysts can view the HTTP service's overall usage, including request and response codes and the original requests. You can use the "Statistics > HTTP" menu to view this info.soot Bookmarks and Filter g Buttons We've covered different types of filtering options, operators and functions. It is time to ereate filters and save them as bookmarks and buttons for later usage. As mentioned in the previous task, the filter toolbar has a filter bookmark section to save user-created filters, which helps analysts re-use favourite/complex filters with a couple of clicks. Similar to bookmarks, you can create filter buttons ready to apply with a single click. Creating and using bookmarks. 18Creating and using display filter buttons. amco RE z ee eee eee SS = ed auce RS a z ance okt = 19Profiles Wireshark is a multifunctional tool that helps analysts to accomplish in-depth packet analysis. As we covered during the room, multiple preferences need to be configured to analyse a specific event of interest. Tt is cumbersome to re-change the configuration for each investigation case, which requires a different set of colouring rules and filtering butions. This is where Wireshark profiles come into play. ‘You can create multiple profiles for different investigation cases and use them accordingly. You can use the "Edit -> Configuration Profiles" menu or the "lower right bottom of the status bar —> Profile" section to create, modify and change the profile configuration. Aliprofies = rote Ze cr Personal Network troubleshooting Persona ‘ret Hunting Personal Bletooth ‘lobat Giosie ‘lobo! Io Reassemy Global Thee Hurtig conse nonecsemby 53553 00005) Comment 1 Pte Packet Filtering This type of filter is used to save only a specific part of the traffic. It is set ‘apture Filters en before capturing traffic and not changeable during the capture, This type of filter is used to investigate packets by reducing the number o! [Display Filters visible packets, and it is changeable during the capture. Note: You cannot use the isplay filter expressions for capturing traffic and vice versa.The typical use case is capturing everything and filtering the packets according to the event of interest. Only experienced professionals use capture filters and sniff traffic. This is why Wireshark supports more protocol types in display filters. Capture Filter Syntax These filters use byte offsets hex values and masks with boolean operators, and it is not easy to understand/predict the filter's purpose at first glance. The base syntax is explained below: ‘+ Scope: host, net, port and portrange. * Direction: src, dst, sre or dst, ste and dst, * Protocol: ether, wlan, ip, ip6, arp, ratp, tep and udp. ‘+ Sample filter to capture port 80 traffic: p port & ‘You can read more on capture filter syntax from here and here. A quick reference is available under the "Capture —> Capture Filters" menu. Reeshineraces Display Filter Syntax This is Wireshurk’s most powerful feature. It supports 3000 protocols and allows condueting packet- level searches under the protocol breakdown. The official "Display Filter Reference” provides all supported protocols breakdown for filtering. + Sample filter to capture port 80 traffic: : Wireshark has a built-in option (Display Filter Expression) that stores all supported protocol structures to help analysts ereate display filters. We will cover the "Display Filter Expression" menu later. Now let's understand the 2fundamentals of the display filter operations. A quick reference is available under the "Analyse —> Display Filters" menu. Dil ier sco Disp iter Exoeson. oy acl caress |] Sector meta ‘payasriter Men emi nein. OTH aartteness — ESPCRTE Reem es sad anagem ShemPadet yes. ASHI Comparison Operators You can create display filters by using different comparison operators to find the event of interest ‘The primary operators are shown in the table below. English Description. Example “a qual eae a0 ne Not equal ee ae 8 & Greater than a k < Les Than eaci we Greaterthanoreawalt te = Less than or equal a | palo Note: Wireshark supports decimal and hexadecimal values in filtering. You ean use any format you want according to the scarch you will conduct. Logical Expressions Wireshark supports boolean syntax. You can create display filters by using logical operators as well. English Description Example and && Lapa AND | (eee nT ANT a i Logical OR Tom = 0TH) OF womoe ! Logical NOT ‘ape T0100 Note: Usage of rasne is deprecated; using it could] provide inconsistent results, Using the sate) style is} suggested for more consistent results Packet Filter Toolbar The filter toolbar is where you cteate and apply your display filters. It is a smart toolbar that helps you create valid display filters with ease. Before starting to filter packets, here are a few tips: * Packet filters are defined in lowercase. + Packet filters have an autocomplete feature to break down protocol details, and each detail is represented by a "dot". + Packet filters have a three-colour representation explained below. Green Valid filter Red Invalid filter Warning filter. This filter works, but itis unreliable, and it is suggested to| ‘change it with a valid filter Yellow Protocol Filters As mentioned in the previous task, Wireshark supports 3000 protocols and allows packet-level investigation by filtering the protocol fields. This task shows the creation and usage of filters against different protocol fields. IP Filters IP filters help analysts filter the traffic according to the IP level information from the packets (Network layer of the OSI model). This is one of the most commonly used filters in Wireshark, These filters filter network-levelinformation like IP addresses, version, time to live, type of servi ‘The common filters are shown in the given table. Filter Description " Show all IP packets Ea Show all packets containing IP adidress [Link] ina iainsopa Show all packets containing IP addresses from 10.10,10.0/24 subnet, Show all packets originated from 10,10.10.111 Show all packets sent to 10,10,10.111 [Link] vs [Link] Note: The [Link]étr filters the traffic without considering the packet direction. The ip-se‘[Link] filters the packet depending on the packei direction. TCP TCP filters help analysts filter the traffic according to protocol-level information from the packets, (Transport layer of the OSI model). These filters filter transport protocol level information like source and destination ports, sequence number, acknowledgement number, windows size, timestamps, flags, length and protocol errots. Filter Deseription Filter Expression ae Show all TCP packets aaa Show ith port 80 all UDP packets with port $3 Show vesemeieu | Show all TCP packets) cigecjo iow | all UDP packers originating from port 1234 originating from port 1234 flags, and checksum values.‘Show all UDP. packets sent to port 5353 err) Show all TCP packets sent | ganesh to port 80 Application Level Protocol Filters | and DNS Application-level protocol filters help analysts filter the traffic according to application protocol level information from the packets (Application layer of the OST model ). These filters filter application-specific information, like payload and linked data, depen ‘on the protocol type. = asin | Fae i Bev es er re = response code) —o all DNS requests = ae an ‘nn reawestamethod Stow Show all DNS "A" aDisplay Filter Expressions ‘+ Wireshark has a built-in option (Display Filter Expression) that stores all supported protocol structures to help analysts create display filters. When an analyst can't recall the required filter for a specific protocol or is unsure about the assignable values for a filter, the Display Filter Expressions menu provides an easy-to-use display filter builder guide. It is available under the "Analyse -> Display Filter Expression” menu. Display Fite Maco. [Bs og Saban ‘Apply ariter Prepare ater Conversation Fier Enabled Protocols, caulestioe Decode as Reload Lue Pluses testes, Follow show Packet Bytes. ‘eioshitso expert formationAdvanced Filtering So far, you have leamed the basies of packet filtering operations. Now it is time to focus on specific packet details for the event of interest. Besides the operators and expressions covered in the previous room, Wireshark has advanced operators and functions. These advanced filtering options help the analyst conduct an in-depth analysis of an event of interest, “contains” Filter contains Type ‘Coaipartion Opaalat rch a value side pockets, Ht cusesenitive wd provides similar Description Sour e hens ee fictionality to the "Find” option by focusing ona specific Feld ime Find all "Apache® servers Workiton List all HITTP packets were packes "server field contains the "Apache" keyword. Usage a saseeexe 2use232t weeRees persusaussaeassuees SeesaunR re aey ‘TanaaamAaSeAGRAPH TEARS Evasseroseees # ae Filter matches Type ‘Comparison Operator Search a patiern of a regular expression, It is ease insensitive, and complex Description ene ae = ‘queries have a margin of error. Example Find all .php and .html pages“Wecétionn List all HTTP packets where packets’ "host" fields match keywords "php" or him". Usage ‘penta yt seeeee eh EESRaHe RSF SNe erterereretett deeeeserreesay rataseseeat eeasesaae: easevaney: ea © fy] ieswseeusaxsaueuans Filter in Type Set Membership Deseription Search a value or field inside ofa specific seope/range. Example Find all packets that use ports 80, 443 or 8080, ae List all TCP packeis where packets’ "port" fields have values 80, 443 or S080, Usage ‘epi 8043 S00SES Sores a bgt Esa eeelea! r SeSeREseE: a 3 seeaesse Seaneaesaesseeaseas qeoweavurvareattes' ieseearxnenuaesaey, errr: pBaserogeraravanesl urpeestoscenrerseauue pesvsvestunueraete: gasavaxnzzaaaenatni cunespacetenteaazes: epeesaeeeys Seawseee 333: searansuane Newreeerece reese | Filter: "upper" Filter ‘upper Type Function Description ‘Convert a string value to uppercase, Example Findall “APACHE” server. Convert all HTTP packets’ “server” fields to uppercase and list packets that contain the "APACHE" keyword. ‘Workflow Usage spent) oni APACHE) re Filter: "lower" Filter lower Type Funetion Description Convert a string value to lowercase. Example Find all “apache” servers. SWecitiowe Convert all HTTP packets! "scrver" fields info to lowercase and list packets that contain the "apache" keyword. Usage ower server comin "aache™Filter: "string" i i Filter string Type Function Description Convert a non-string value to a string. Example Find all frames with odd numbers, rating Convert all “frame number" fields to string values, and list frames end with ‘odd values Usage inane mei) riches 578" 31: fe 4 i SiaigadSoa wna tea” sseugestsiedeadeagy Sa k we .| levseeacacicraas er Wireshark: Traffic Analysis Nmap Scans Nmap is an industry-standard tool for mapping networks, identifying live hosts and discovering the services. As it is one of the most used network scanner tools, a security analyst should identify the network patterns created with it. This section will cover identifying the most common Nmap scan types. + TCP connect scans * SYN scans + UDP scans tis essential to know how Nmap scans work to spot sean activity on the network. However, it is impossible to understand the scan details without using the correct filters. Below are the base filters to probe Nmap sean behaviour on the network. ‘TCP flags in a nutshell, Notes. ‘Wireshark Filters Global seareh, at + Only SYN flag. * SYN flag is | * spp 2# eames set, The rest of the bits are not ‘important. + Only ACK flag. + ACK flag is sel, The rest of the bits are not | * jj ies-=i6* wy Dae ‘important+ Only SYN, ACK flags. + SYN and ACK are set, The rest of the bits are not important + Only RST flag, » RST flag is set, The rest of the bits are not | * 6 important, + Only RST, ACK flags. * RST and ACK are set. The rest of the | * P!* bits are not important, + Only FIN flag + FIN flag is set, The rest of the bits are | * icptiss1* eimai not important. TCP ‘TCP Connect Scan in a nutshell: + Relies on the three-way handshake (needs to finish the handshake process) Usually conducted with command. + Used by non-privileged users (only option for a non-root user). + Usually has a windows size larger han 1024 bytes as the request expects some data due to the nature of the protocol. ‘Open TCP Port Open TCP Port (Closed TCP Port SYN > + SYN, | # SYN + <- SYN, ACK + ACK > + RST, | # SYN—> + RST, ACK + ACK > ACK - ACK The images below show the three-way handshake process of the open and close TCP ports. Images and peap samples are split to make the investigation easier and understand each case's details. Open TCP port (Connect):eee ane gee ee mee Tee ae = ae The above images provide the paiterns in isolated traffic. However, it is not always easy to spot the given patterns in big capture files. Therefore analysts need to use a generic filter to view the initial anomaly patterns, and then it will be easier to focus on a specific traffic point. + The given filter shows the TCP Connect sean patterns in a capture file. SYN Scans ‘TCP SYN Scan in a nutshell: + Doesn't rely on the three-way handshake (no need to finish the handshake process). Usually conducted with Used bys: <5 command. privileged users. Usually have a size less than or equal to 1024 bytes as the request is not finished and it doesn't expect to receive data. ‘Open TCP Port Close TCP Port+ SYN -> + <~ SYN,ACK + RST-> | « SYN —> + <- RST,ACK Open TCP port (SYN): ‘The given filter shows the TCP SYN scan patterns in a capture file UDP ‘UDP Scan in a nutshell: + Doesn't require a handshake process * No prompt for open ports + ICMP error message for close ports Usually conducted with command. jopen UDP Port | Closed UDP Port + UDP packet -> + ICMP Type 3, Code 3 message. (Destination + UDP packet > B unreachable, port unreachable)Closed (port no 69) and open (port no 68) UDP ports: The above image shows that the closed port returns an ICMP error packet. No further information is provided about the error at first glanee, so how can an analyst decide where this error message belongs? * The ICMP error message uses the original request as encapsulated data to show the source/reason of the packet. Once you expand the ICMP section in the packet details pane, you will see the encapsulated data and the original request, as shown in the below image.ee (sates same) fois ehetout dees ytsacey cities) amce® TRE hope adage, 7ARP Poisoning & Man In The Middle! + ARP protocol, or Address Resolution Protocol (ARP), is the technology responsible for allowing devices to identify themselves on a network. * Address Resolution Protocol Poisoning (also known as ARP Spoofing or Man In The Middle (MITM) attack) is a type of attack that involves network jamming/manipulating by sending malicious ARP packets to the default gateway. The ultimate aim is to manipulate the "IP to MAC address table” and sniff the traffic of the target host. ‘There are a variety of tools available to conduct ARP attacks. However, the mindset of the attack is static, 50 it is easy to detect such an attack by knowing the ARP protocol workflow and Wireshark skills. ARP analysis in a nutshell: + Works on the local network * Enables the communication between MAC addresses ¢ Not a secure protocol + Nota routable protocol + It doesn't have an authentication function + Common pattems are request & response, announcement and gratuitous packets, Before investigating the traffic, let's review some legitimate and suspicious ARP packets. The legitimate requests are similar to the shown picture: a broadcast request that asks if any of the available hosts use an IP address and a reply from the host that uses the particular IP address. Notes Wireshark filter Global search, ton "ARP" options for grabbing the low. hanging fiuits: + Opcode 1: ARP requests. + Opcode 2: ARP responses, « Hu Hunt: Possible ARP poisoning detection + Hunt: Possible ARP flooding from) detection:Eitact i, Bet bo scitenrm, ase teeter ES Ba a nee ane aa Tope Been ese Re as A suspicious situation means having two different ARP responses (conflict) for a particul address. In that case, Wireshark's expert info tab warns the analyst. However, it only shows the second occurrence of the duplicate value to highlight the conflict. Therefore, identifying the malicious ate one is the analyst's challenge. A possible IP spoofing case is shown inHere, knowing the network architecture and inspecting the traffic for a specific time frame can help detect the anomaly. As an analyst, you should take notes of your findings before going further. This will help you be organised and make it easier to correlate the further findings. Look at the given picture; there is a conflict; the MAC address that ends with "b4" crafted an ARP request with the "192,168.1.25" IP address, then claimed to have the "[Link]" IP address, PoieP ats mach. | 1 ales smo fom a Te a # IP: 192,168,125 ~wa 2 MAC adress eimet he same uF attempt. IP adress is possible gateway address ve ins 00:0e:29:e2:18:b4 ends with "b4") * MAC. yew IP address, | (W:6:29:62:18:b4 +P: [Link] Possible ARP flooding attempt. Let's keep inspecting the traffic to spot any other anomalies. Note that the case is split into multiple capture files to make the investigation easier. fe dst yew cue anaes gan Hee ess Joh Be 2 mae = At this point, it is evident that there is an anomaly. A security analyst cannot ignore a flood of ARP requests. This could be malicious activity, scan or network problems, There is a new anomaly; the MAC address that ends with "b4" crafted multiple ARP requests with the "[Link]" IP address. Let's focus on the source of this anomaly and extend the taken notes.Notes. Detection Notes Findings Pose Paresh] 1 aes weed fom n |S MAC address. ee . 2 MAC addresses claimed the same IP | * MACI: Possible ARP spoofing) address ([Link]).The " [Link]" | SO:78:b3:f3:cds!4 + attempt. IP address is a possible gateway address. | MAC 2; (00:00:29%e2:18:b4 The MAC address that ends with "ba" « claims to have a differentinew IP address. | MAC: 00:0c:29%e2:18:b4 + IP: [Link] Possible ARP spoofing attempt. ‘The MAC address that ends with “b4" | « MAC crafted multiple ARP requests against a | 00:0e:29:¢2:18:b4 + IP: range of IP addresses, 192,168.1-x5x Possible ARP flooding attempt. Up to this point, it is evident that the MAC address that ends with "b4” owns the "[Link]" IP address and crafted suspicious ARP requests against a range of IP addresses. It also claimed to have the possible gateway address as well. Let's focus on other protocols and spot the reflection of this anomaly in the following sections of the time frame. There is HTTP traffic, and everything looks normal at the IP level, so there is no linked information with our previous findings. Let's add the MAC addresses as columns in the packet list pane to reveal the communication behind the IP addresses. aOne more anomaly! The MAC address that ends with "b4" is the destination of all HTTP packets! It is evident that there is a MITM aitack, and the attacker is the host with the MAC address that ends with “b4". All traffic linked to "[Link]" IP addresses is forwarded to the malicious host. Let's summarise the findings before concluding the investigation Detection Notes Findings IP fo MAC matches, | 3 IP ty MAC adress matches. Attacker The attacker created noise with ARP packets. Router/gateway Gateway address, Vietim The attacker sniffed all traffic of the victim. Detecting these bits and pieces of information in a big capture file is challenging. However, in real-life cases, you will not have “tailored data" ready for investigation. Therefore you need to have the analyst mindset, knowledge and tool skills to filter and detect the a nomalies, Identifying Hosts: DHCP, NetBIOS and Kerberos Identifying Hosts ‘+ When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match. * One of the best methods is identifying the hosis and users on the network to decide the investigation's starting point and list the hosts and users associated with the malicious traffic/activity. + Usually, enterprise networks use a predefined pattern to name users and hosts. While this makes knowing and following the inventory easier, it has good and bad sides. The good side is that it will be easy to identify a user or host by looking at the name. The bad side is that it will be easy to clone that pattern and live in the enterprise network for adversaries. There are multiple solutions to avoid these kinds of activities, but for a security analyst, itis still essential to have host and user identification skills Protocols that can be used in Host and User identification: + Dynamic Host Configuration Protocol (DHCP) traffic 42+ NetBIOS (NBNS) traffic © Kerberos traffic DHCP Dynamic Host Configuration Protocol (DHCP), is the technology responsible for managing automatic IP address and required communication parameters assignment, DHCP investigation in a nutshell: Notes Wireshark Filter Global search, + RRO Filtering the proper DHCP packet options is vital to finding ‘an event of interest, * "DHCP Request" packets contain the hostname information + "DHCP ACK" packets represent the aecepted requests + “DHCP NAK" packets represent denied requests Due to | * Request: issuninses 9 the nature of the protocol, only "Option 93" (request type) | * ACK: sienipisninop = s* NAK: hhas predefined static values. You should filter the packet | \!->sxnevr =e type first, and then you ean filter the rest of the options by “applying as column" or use the advanced fillers like contains" and matches" "DHCP Request" options for grabbing the low- hanging fruits: « Option 12: Hostname. « Option aT ‘50: Requested IP address, « Option $1: Requested IP lease time, + Option 61: Client's MAC address. “DHCP ACK" options for grabbing the low-hanging fruits Option 15: Domain name. + Option Sl: Assigned IP lease time, ‘As the message could be unique according to the case/situation, It is suggested 9 read the message "DHCP NAK" options for grabbing the low-hanging fruits} instead of filtering it, + Option 56: Message (rejection details/reason), Thus, the analyst could create a more reliable hypothesis/result by understanding the event circumstances,auppeyonyy: HUHNE 3h supenyagre BBRaEREaEE 5) geaeseness: NetBIOS (NBNS) Analysis ‘NetBIOS or Network Basic Input/Output System is the technology responsible for allowing applications on different hosts to communicate with each other. ‘NBNS investigation in a nutsh Notes. Wireshark Filter Global search. i "NBNS" options for grabbing the low-hanging fruits: + Queries: Query details. «Query details could : SER contain "name, Time to live (TTL) and 1P address details” NetBIOS registration requests asKerberos Analysis » Kerberos is the default authentication service for Microsoft Windows domains, + It is responsible for authenticating service requests between two or more computers over the untrusted network. The ultimate aim is to prove identity securely. Kerberos investigation in a nutshell: Notes ‘Wireshark Filter, Global search, 2 User account search: + CNameString: The username. Note: Some packets) \ajouesini could provide hostname information in this field. To avoid this confusion,| cosine “iswou” * filter the "S" value. The values end with "S" are hostnames, and the ones] !s-me%-ssons nl without it are user names. Se "Kerberos" options for grabbing the low-hanging fruits: * pyno: Protocol version, + realm: Domain name tor the genorated ticket. ssname: Service and domain name for the generated ticker. iont IP address end NetBIOS name. Note: the “addresses” information is only available in request packets. + addresses: sugPerrerrert juaaaesaey Tunneling Traffic: DNS and ICMP Tunnelling Traffic: ICMP and DNS + Traffic tunnelling is (also known as "port forwarding”) transferring the data/resources in a secure method to network segments and zones. * It can be used for "internet to private networks" and "private networks to internet” flow/direction. + There is an encapsulation process to hide the data, so the transferred data appear natural for the case, but it contains private data packets and transfers them to the final destination securely. Tunnelling provides anonymity and traffic security. Therefore it is highly used by enterprise networks, However, as it gives a significant level of data encryption, attackers use tunnelling to bypass security perimeters using the standard and trusted protocols used in everyday traffic like ICMP and DNS. Therefore, for a security analyst, it is erucial (o have the ability to spot ICMP and DNS anomalies. ICMP Analysis + Intemet Control Message Protocol (ICMP) is designed for diagnosing and reporting network communication issues. It is highly used in etror reporting and testing, + As it is a trusted network layer protocol, sometimes it is used for denial of service (DoS) attacks; also, adversaries use it in data exfiltration and C2ICMP analysis in a nutshell: + Usually, ICMP tunnelling attacks are anomalies appearing/starting after a malware execution or ‘vulnerability exploitation. * As the ICMP packets can transfer an additional data payload, adversaries use this section to exfiltrate data and establish a C2 connection. + It could be a TCP, HTTP or SSH data. As the ICMP protocols provide a great opportunity to camry extra data, it also has disadvantages. © Most enterprise networks block custom packets or require administrator privileges to create custom ICMP packets. A large volume of ICMP traffic or anomalous packet sizes are indicators of ICMP tunnelling, Still, the adversaries could create custom packets that match the regular ICMP packet size (64 bytes), so it is still cumbersome to detect these tunnelling activities. However, a security analyst should know the normal and the abnormal to spot the possible anomaly and escalate it for further analysis. Notes Wireshark filters, Global seareh = "ICMP" options for grabbing the low-hanging fruits: + Packet length. « ICMP destination addresses. + Encapsulated protocol signs in ICMP payload aPSh BABB ES aeaasexoury: daxseeesae: a7.DNS Analysis + Domain Name System (DNS) is designed to translate/convert IP domain addresses to IP addresses. * It is also known as a phonebook of the internet. As it is the essential part of web services, it is commonly used and trusted, and therefore often ignored, Due to that, adversaries use it in data exfiltration and C2 activities. DNS analysis in a nutshell: + Similar to ICMP tunnels, DNS attacks are anomalies appearing/starting after a malware execution or vulnerability exploitation. * Adversary creates (or already has) a domain address and configures it as a C2 channel. The malware or the commands executed after exploitation sends DNS queries to the C2 server. + However, these queries are longer than default DNS queries and crafted for subdomain addresses. Unfortunately, these subdomain addresses are not actual addresses: they are encoded commands as shown below: “[Link]" + When this query is routed to the C2 server, the server sends the actual malicious commands to the host. + As the DNS queries are a natural part of the networking activity, these packets have the chance of not being detected by network perimeters. A security analyst should know how to investigate the DNS packet lengths and target addresses to spot these anomalies ‘Wireshark, Notes Filter Global search, fo "DNS" options for grabbing the low-hanging fruits: + Query length, + Anomalous and non-regular names in DNS addresses. «| addresses with encoded subdomain addresses. + Known Long DI pattems like duseat and dns2tcp, + Statistical analysis like the anomalous volume of DNS requests for a particular target isable local link device queries.20.288 Sl Cleartext Protocol Analysis Cleartext Protocol Analysis Investigating cleartext protocol traces sounds easy, but when the time comes to investigate a big network trace for incident analysis and response, the game changes. Proper analysis is more than following the stream and reading the cleartext data. For a security analyst, itis important to create statistics and key results from the investigation process. As mentioned carlier at the beginning of the Wireshark room series, the analyst should have the required network knowledge and tool skills to accomplish this. Let's simulate a cleartext protocol investigation with Wireshark! FTP Analysis File Transfer Protocol (FTP) is designed to transfer files with ease, so it focuses on simplicity rather than security. As a result of this, using this protocol in unsecured environments could create security issues like: * MITM attacks © Credential stealing and unauthorised access * Phishing 49+ Malware planting * Data exfiltration FTP analysis in a nutshell: Notes Wireshark Filter Global search 'P” options for grabbing the low-hanging fruit series: Information request responses, + x2x series: Connection messages, © x3 series: Authentication messages. Note: ‘means command successful, ‘"x1x" series options for grabbing the low-hanging fruits] +211: System status. + 212: Directory status. + 213: File status "2x" series options for grabbing the low-hanging fut: + 220: Service ready. + 227: Entering passive mode, 4 228: Long passive mode. + 229: Extended passive mode "x3x" series options for grabbing the low-hanging fivits: + 230: User login, « 281: User logout. » 3312 ‘Valid usename, + 430: Invalid usemame or password +530: No login, invalid password, "FTP" commands for grabbing the low-hanging fruits: © fruits: + Bruteforee signal: List failed lo Bruteforce signal: List target username. + Password spray signal: List torgots for a static password. n atlempis. * USER: Username. « PASS: Password, + CWD: Current) gos su -ani-— passe * gueepee we wwork directory, LIST: List. — ‘Advance. usages examples for grabbing low- hanging] | asPeres cee ene eee ene see tee ance TRE Cleartext Protocol Analysis: HTTP Analysis + Hypertext Transfer Protocol (HTTP) is a cleartext-based, request-response and client-server protocol. It is the standard type of network activity to request/serve web pages, and by defauit, itis not blocked by any network perimeter, As a result of being unenerypted and the backbone of web traffic, HTTP is one of the must-to-know protocols in traffic analysis. Following attacks could be detected with the help of HTTP analysis: + Phishing pages + Web attacks + Data exfiltration * Command and control traffic (C2) HTTP analysis in a nutshell: Notes Wireshark Filter Global search Note: HTTP2 is a revision of the HTTP protocol for better performance and security. 1t supports binary data a transfer and requestéeresponse multiplexing. “HTTP Request Methods" for grabbing the low-hanging fruits: + rapes GET + POST + Request: Listing all requests FORT poe “HTTP Response Status Codes" for grabbing the low-hanging, tp npmecode 51fiuits: + 200 OK: Request sucesssful. + 301 Moved Permanently: Resource is moved to a new URL/path (permanently). * 302 Moved | 0) + ‘Temporarily: Resource is moved to a new URLipath (temporarily). ¢ | "een 400 Bad Request: Server didnt understand the request. + 401 Unauthorised: URL needs outhorisation (login, ete. + 403 Forbidden: No aceess to the requested URL, + 404 Not Found: Server can't find the requested URL. + 405 Method Not Allowe Used method is not suitable or blocked, + 408 Request Timeouts Request look longer than server wait time, * 500 Internal Server Error: Request not completed, unexpected error. » $03 Service Unavailable: Request not completed server or service is down, “HTTP Parameters" for grabbing the low-hanging fruits: « User agent Browser and operating system identification to a web server application, + Request URI: Points the requested resource from el the server.» Full Mp ree it URK: Complete URI information, “URE: Unifinm Resource Identifier, *HTTP Parameters” for grabbing the low-hanging fruits: + Servers | i jst Server service name, + Host: Hostname of the server + Connection: | = Ye" — Connection status. Line-based text data: Cleartext data provided by the server. * HTML Form URL. Encoded: Web form information, chin "hay User Agent Analysis + As the adversaries use sophisticated technics to accomplish attacks, they try to leave traces similar to natural traffic through the known and trusted protocols. * For a security analyst, i packets. The “user-agent” field is one of the great resoutees for spotting anomalies in HTTP traffic. is important to spot the anomaly signs on the bits and pieces of the + In some cases, adversaries successfully modify the user-agent data, which could look super natural, + A security analyst cannot rely only on the user-agent field to spot an anomaly. + Never whitelist a user agent, even if it looks natural.+ User agent-based anomaly/threat detection/hunting is an additional data source to check and is useful when there is an obvious anomaly. If you are unsure about a value, you can conduct a web search to validate your findings with the default and normal user-agent info (example site). User Agent analysis in a nutshell: ‘Notes ‘Wireshark Filter Global search, » aa GRR Ge ag ERS apie a eh eR NT short time notice, * Non-standard. and custom user agent . inh. ub peng irnocs.("aooa is moe he | See same as "Molla" or "Meza + Audit ols nike | “=== en Nina, Niko, Wizz an samap in the user agent eld Payload dats the ser age Fed TEREEED ES Log4j Analysis + Logdj Analysis refers to the process of examining and assessing the logs generated by the Apache Logdj framework in order to identify security vulnerabilities, operational issues, or other relevant insights within an application or system.+ A proper investigation starts with prior research on threats and anomalies going to be hunted. Let's review the knowns on the "Log" attack before launching Wireshark. Logdj vulnerability analysis in a nutshell: Notes Wireshark Pters Research outcomes for grabbing the low-hangin fruits: + The attack starts with a "POST" request + There ar Known cleartext patterns} ‘jndildap" andl "[Link]" a Satine aes “ieee ie Encrypted Protocol Analysis: Decrypting HTTPS Decrypting HTTPS Traffic + When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security against spoofing, sniffing and intercepting attacks.+ HTTPS uses TLS protocol to enerypt communications, so it is impossible to decrypt the traffic and view the transferred data without having the eneryption/decryption key pait * As this protocol provides a good level of security for transmitting sensitive data, attackers and malicious websites also use HTTPS. * Therefore, a security analyst should know how to use Key files to decrypt encrypted traffic and investigate the traffic activity. The packets will appear in different colours as the HTTP traffic is encrypted. Also, protocol and info details (actual URL address and data returned from the server) will not be fully visible. The first image below shows the HTTP packets enerypted with the TLS protocol. The second and third images demonstrate filtering HTTP packets without using a key log file. eee amse "RO Be Eat Yew i Goran ayaee Gates Ten Mines Toe He ance ORE = fn os Additional information for HTTPS : Notes. Wireshark Filter “HTTPS Parameters" for grabbing the low-hanging fruits: + Request: | * wgoqex * 4 * Listing all requests + TLS: Global TLS search + TLS Client Request * TLS | ss! Server response + Local Simple Service Discovery ” Protocol (SSDP) Note: SSDP is a network protocol thet provides ‘eta pe advertisement and discovery of network services. =e ‘Similar to the TCP three-way handshake process, the TLS protocol has its handshake process. ‘The first two steps contain "Client Hel "and "Server Hello” messages.The given filters show the initial hello packets in a capture file. These filters are helpful to spot which IP addresses are involved in the TLS handshake. Client Hello: [Link] Server Hello: (1p segue o Usialakeiype = 2) ad Gs)saa] An encryption key log file is a text file that contains unique key pairs to decrypt the encrypted traffic session, ‘These key pairs are automatically created (per session) when a connection is established with an SSL/TLS-cnabled webpage. As these processes are all accomplished in the browser, you need to configure your system and use a suitable browser (Chrome and Firefox support this) to save these values as @ key log file,+ Todo this, you will need to set up an environment variable and create the SSLKEYLOGFILE, and the browser will dump the keys to this file as you browse the web. SSLITLS key pairs are created per session at the connection time, so it is important to dump the keys during the traffic capture. Otherwise, to decrypt captured traffic. not possible to create/generate a suitable key log file You can use the "right-click" menu or "Edit > Preferences —> Protocols — > TLS" menu to addtemove key log files. Adding key log files with the right-click” menu: ‘Viewing the traffic with/without the key log files:ag crrneste, oom) ‘The above image shows that the traffic details are visible after using the key log file. Note that the packet details and bytes pane provides the data in different formats for investigation. Decompressed header info and HTTP2 packet details are available after decrypting the traffic. Depending on the packet details, you can also have the following data formats: + Frame «© Decrypted TLS + Decompressed Header ¢ Reassembled TCP * Reassembled SSL HuWt Cleartext Credentials! Bonus: Hunt Cleartext Credentials!Some Wireshark dissectors (FTP, HTTP, IMAP, pop and SMTP) are programmed to extract cleartext passwords from the capture file. You can view detected credentials using the "Tools —> Credentials" menu. This feature works only after specific versions of Wireshark (v3.1 and later). Since the feature works only with particular protocols, it is suggested to have ‘manual checks and not entirely rely on this feature to decide if there is a cleartext credei traffic. in the ‘Once you use the feature, it will open a new window and provide detected credentials. It will show the packet number, protocol, usemame and additional information. This window is clickable; clicking on the packet ‘number will select the packet containing the password, and clicking on the username will select the packet containing the username info. The additional part prompts the packet number that contains the username. Packet N Proteeol ‘Username Additional into FTP Username in packet 12 FTP ‘Username in packet: 15 Fre Username in packet 25 FP Username in packet: 28 FP ‘Username in packet 57 Fre ‘Username in packet: 62 FP Username in packet 8 FP ‘Username in packet: $3, Fe Username in packet: 97 FP Fre Caese: Actionable Results! + Wireshark is not all about packet details; it can help you to create firewall rules ready to implement, with a couple of clicks. + You can create firewall rules by using the "Tools > Firewall ACL Rules" menu. Once you use this feature, it will open a new window and provide a combination of rules (IP, port and MAC address- based) for different purposes. Note that these rules are generated for implementation on an outside firewall interface Currently, Wireshark can create rules for: ¢ Netfilter (iptables) + Cisco IOS (standard/extended)IP Filter (ipfilter) [PFirewall Cipfiw) Packet filter (pl) Windows Firewall (netsh new/old format) rend NOT ninth source 104847018 abies-opoend PUT i netce end -preteaep sauce 2021p ORO Credentials lua ‘Gabcscappend Ur tnetece eho protec tp source 10234125 25492~ Souter S38 omg O80 Ss rn a ia cee tal tae 19 s2.7/2~= [Eeneraector meitoriomey a reo cs Tasks: Task 1: Capturing and Exporting Objects 4. Capture network traffic using Wireshark 2. Identify and extract transferred files from HTTP, SMB, or TFTP streams, 3. Document findings with screenshots. Task 2: Time Display Format Analysis 4. Change Wireshark's time display format to UTC. 2. Compare and analyze packet timing differences, 3. Submit observations with relevant screenshots. Task 3: Expert Info Analysis 1. Identify anomalies using Wireshark's Expert Info feature. 2. Classify errors, wamings, and malformed packets. 3. Provide a detailed explanation of identified issues. Task 4: Applying Filters for Traffic Analysis 4. Use “Apply as Filter” to isolate specific network traffic. 2. Utilize conversation filers to analyze related packets. 3. Provide examples and screenshots of applied fiters. Task 5: Analyzing HTTP Streams 1. Follow an HTTP stream to reconstruct application-layer data 2. Identify and document potential sensitive information. 3. Submit a report including step-by-step findings. Task 6: Statistical Analysis et4. Use the Statistics menu to analyze protocol hierarchy and endpoints. 2. Extract key insights about network traffic patterns. 3. Document results and interpretations. Task 7: Resolving Addresses and Protocol Hierarchy 41. Use Wireshark to resolve IP addresses to hostnames. 2. View the protocol hierarchy to analyze network traffic structure, 3. Submit a summary of key findings. Submission Requirements: + Adetailed report including ‘¢ Screenshots of each task performed ‘© Explanation of results and insights gained. © Summary of findings and security recommendations. + Submit the report by Next Lab. This assignment will help students develop practical skills in network packet analysis using Wireshark. Good luck!