Welcome!

Agile Computing Authors: Stackify Blog, Derek Weeks, Harry Trott, Liz McMillan, Elizabeth White

Related Topics: Cloud Security, Industrial IoT, Microservices Expo, Adobe Flex, Agile Computing

Cloud Security: Article

Capture File Filtering with Wireshark

Needle in a Haystack

Intrusion detection tools that use the libpcap C/ C++ library [1] for network traffic capture (such as Snort [2] and Tcpdump [1]) can output packet capture information to a file for later reference. The format of this capture file is known as pcap. By capturing packet data to a file, an investigator can return later to study the history of an intrusion attempt – or to turn up other important clues about clandestine activity on the network.

Of course, the traffic history data stored in a pcap file is much too vast to study by just viewing the file manually. Security experts use specialized filtering tools to search through the file for pertinent information. One way to look for clues in a pcap file is to use the Wireshark protocol analysis tool [3] and its accompanying command-line utility tshark.

Wireshark is included by default on many Linux distros, and if not, it is available through the leading package repositories. You can also download Wireshark through the project website [4]. In this article, I describe how to use Wireshark and tshark to search a pcap file for information on network activity. I will assume you already have a pcap file ready for investigation. For more on how to capture a pcap file with Tcp-dump, see my article “Intruder Detection with Tcpdump,” which is available online at the ADMIN magazine website [5].

tshark at the Command Line
The tshark utility is a simple tool included with the Wireshark package that lets you filter the contents of a pcap file from the command line. To get a view of the most significant activity, I use the following command:

$ tshark ‑nr dumpfile1.gz ‑qz "io,phs" > details.txt

The ‑n switch disables network object name resolution, ‑r indicates that packet data is to be read from the input file, in this case dumpfile1.gz. The ‑z allows for statistics to display after it finishes reading the capture file, the ‑q flag specifies that only the statistics are printed, and the > redirection
sends the output to the file called details.txt. See Figure 1 for the output of this information. To view a list of help commands used with tshark, type:

$ tshark ‑h

And for a list of ‑z arguments type:

$ tshark ‑z help

Figure 1

Say you would like to know whether a particular IP address appeared in a packet dump and what port it was connecting on. The following command line checks the dump file for the IP address 98.139.126.21:

$ tshark ‑V ‑nr dumpfile.gz ip.src == 98.139.126.21 | grep "Source port" | awk {'print $3'} | sort ‑n | uniq 80

The resulting output on the line following the command shows that the packet dump file recorded IP address 98.139.126.21 having connections on port 80.

If you were given a packet dump file and asked to find possible IRC traffic on your network, how would you do it? First, you would need to know what port numbers were associated with IRC traffic, and that could be accomplished with Google or by issuing the following command:

$ grep irc /usr/share/nmap/nmap‑services | grep tcp

Figure 2 shows the results of the preceding command.

Figure 2

Now I can search the packet dump and look for evidence of IRC traffic using the following commands:

$ tshark ‑nr dumpfile1.gz 'ip.addr==172.16.134.191 and tcp.port >=  6667 and tcp.port <= 6670 and irc' |  awk {'print $3,$4,$5,$6'} | sort ‑n | uniq ‑c

Figure 1: tshark statistics output.
Figure 2: Locating IRC port numbers with grep.
Figure 3: IRC connections found in the packet dump.
Figure 4: The Wireshark startup window.

The breakdown of this command is shown in Table 1, and the output is in Figure 3.

Figure 3

In the GUI
The Wireshark GUI application is easier on the eyes, and it provides some options that aren’t available at the command line. You can start Wireshark from the Application menu or from the terminal.  To load a capture file, select Open in the startup window (Figure 4) or select File | Open from the menubar.  Once you have a packet capture file loaded, you can start searching packet dumps within the Wireshark interface.

Figure 4

The Filter box below the Wireshark toolbar lets you enter criteria for the search. For instance, to search for all the Canonical Name records within the capture file, type in the following filter: dns.resp.type == CNAME (see Figure 5).  After you enter a filter, remember to clear the filter text to see the full file before starting a new search.

Figure 5

Table 1: Parts of a tshark Command

Option Description
‘ip.addr==172.16.134.191         This is my network
and tcp.port >= 6667                   Start of the port range
and tcp.port <= 6670                   End of the port range
and irc’                                           Searches for IRC traffic only
awk {‘print $3,$4,$5,$6’}             Prints the third through sixth patterns from each matching line
sort ‑n                                            Sorts according to string numerical value
uniq ‑c                                            Only prints the number of matches that are unique

Digging deeper, if I want to know how long a client resolver cached the IP address associated with the name cookex.amp.gapx.yahoodns.net (Figure 6), I would enter the following filter:

dns.resp.name == "cookex.amp.gapx. yahoodns.net"

Figure 6

The filter ip.addr == 10.37.32.97 gives information on all communications that involve 10.37.32.97 in the packet dump. If needed, use && to isolate to a specific protocol. The filter ip.dst == 10.37.32.97 or ip.src == 10.37.32.97 looks for a source or destination IP address.

How could I find the password used over Telnet between two IP addresses? For example, if a user at 172.21.12.5 is using Telnet to access a device at 10. 37. 140.160, I can enter:

ip.dst == 10.37.140.160 && ip.src == 172.21.12.5 && telnet.data contains "Password"

The preceding command will list the connections that meet the search requirement, and you can right-click on the packet and click Follow TCP Stream to view the password. (See Figures 7 and 8.)

Figure 7

Figure 8

Note: A much easier way to get the password on the network, if you were sniffing the traffic instead of reading from a capture file, would be to use ettercap, as follows:

$ ettercap ‑Tzq //23

To discover whether someone was viewing a suspicious web page, I can perform a filter search to find out what picture the person at IP address 10.225.5.107 was viewing at Yahoo (216.115.97.236) with the following filter:

ip.dst == 10.225.5.107 && ip.src == 216.115.97.236 && (image‑jfif || image‑gif)

Figure 9

Figure 9 shows the results. If you then right-click on a line in the output and select Follow TCP Stream for the results shown in Figure 10.
The second line in the Follow TCP Stream output specifies that wynn‑ rovepolitico.jpg is the image this person was viewing on the site.

Figure 10

Conclusion
Wireshark can do more than just watch the wires in real time. If you save a snapshot of network activity in a capture file in the pcap format, you can use Wireshark to search through the file to look for clues about nefarious activity.

In this article, I described how to search for information in a capture file using Wireshark and the tshark command-line tool.

Info

[1] Tcpdump and Libpcap: http://www.tcpdump.org/
[2] Snort: http://www..snort.org
[3] Wireshark: http://www.wireshark.org/
[4] Wireshark Download: http://www.wireshark.org/download.html
[5] “Intruder Detection with Tcpdump” by David J. Dodd: http://www.admin‑magazine.com/Articles/Intruder‑Detection‑with‑tcpdump/

More Stories By David Dodd

David J. Dodd is currently in the United States and holds a current 'Top Secret' DoD Clearance and is available for consulting on various Information Assurance projects. A former U.S. Marine with Avionics background in Electronic Countermeasures Systems. David has given talks at the San Diego Regional Security Conference and SDISSA, is a member of InfraGard, and contributes to Secure our eCity http://securingourecity.org. He works for Xerox as Information Security Officer City of San Diego & pbnetworks Inc. http://pbnetworks.net a Service Disabled Veteran Owned Small Business (SDVOSB) located in San Diego, CA and can be contacted by emailing: dave at pbnetworks.net.

@ThingsExpo Stories
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, will examine the regulations and provide insight on how it affects technology, challenges the established rules and will usher in new levels of diligence a...
An increasing number of companies are creating products that combine data with analytical capabilities. Running interactive queries on Big Data requires complex architectures to store and query data effectively, typically involving data streams, an choosing efficient file format/database and multiple independent systems that are tied together through custom-engineered pipelines. In his session at @BigDataExpo at @ThingsExpo, Tomer Levi, a senior software engineer at Intel’s Advanced Analytics ...
In the enterprise today, connected IoT devices are everywhere – both inside and outside corporate environments. The need to identify, manage, control and secure a quickly growing web of connections and outside devices is making the already challenging task of security even more important, and onerous. In his session at @ThingsExpo, Rich Boyer, CISO and Chief Architect for Security at NTT i3, discussed new ways of thinking and the approaches needed to address the emerging challenges of security i...
SYS-CON Events announced today that Dasher Technologies will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Dasher Technologies, Inc. ® is a premier IT solution provider that delivers expert technical resources along with trusted account executives to architect and deliver complete IT solutions and services to help our clients execute their goals, plans and objectives. Since 1999, we'v...
There is only one world-class Cloud event on earth, and that is Cloud Expo – which returns to Silicon Valley for the 21st Cloud Expo at the Santa Clara Convention Center, October 31 - November 2, 2017. Every Global 2000 enterprise in the world is now integrating cloud computing in some form into its IT development and operations. Midsize and small businesses are also migrating to the cloud in increasing numbers. Companies are each developing their unique mix of cloud technologies and service...
SYS-CON Events announced today that IBM has been named “Diamond Sponsor” of SYS-CON's 21st Cloud Expo, which will take place on October 31 through November 2nd 2017 at the Santa Clara Convention Center in Santa Clara, California.
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
SYS-CON Events announced today that Akvelon will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Akvelon is a business and technology consulting firm that specializes in applying cutting-edge technology to problems in fields as diverse as mobile technology, sports technology, finance, and healthcare.
WebRTC is great technology to build your own communication tools. It will be even more exciting experience it with advanced devices, such as a 360 Camera, 360 microphone, and a depth sensor camera. In his session at @ThingsExpo, Masashi Ganeko, a manager at INFOCOM Corporation, will introduce two experimental projects from his team and what they learned from them. "Shotoku Tamago" uses the robot audition software HARK to track speakers in 360 video of a remote party. "Virtual Teleport" uses a...
SYS-CON Events announced today that Datera will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera offers a radically new approach to data management, where innovative software makes data infrastructure invisible, elastic and able to perform at the highest level. It eliminates hardware lock-in and gives IT organizations the choice to source x86 server nodes, with business model option...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, Cloud Expo and @ThingsExpo are two of the most important technology events of the year. Since its launch over eight years ago, Cloud Expo and @ThingsExpo have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, I provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading the...
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
SYS-CON Events announced today that Elastifile will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Elastifile Cloud File System (ECFS) is software-defined data infrastructure designed for seamless and efficient management of dynamic workloads across heterogeneous environments. Elastifile provides the architecture needed to optimize your hybrid cloud environment, by facilitating efficient...
SYS-CON Events announced today that GrapeUp, the leading provider of rapid product development at the speed of business, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market acr...
"We provide IoT solutions. We provide the most compatible solutions for many applications. Our solutions are industry agnostic and also protocol agnostic," explained Richard Han, Head of Sales and Marketing and Engineering at Systena America, in this SYS-CON.tv interview at @ThingsExpo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Golden Gate University will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Since 1901, non-profit Golden Gate University (GGU) has been helping adults achieve their professional goals by providing high quality, practice-based undergraduate and graduate educational programs in law, taxation, business and related professions. Many of its courses are taug...
Recently, IoT seems emerging as a solution vehicle for data analytics on real-world scenarios from setting a room temperature setting to predicting a component failure of an aircraft. Compared with developing an application or deploying a cloud service, is an IoT solution unique? If so, how? How does a typical IoT solution architecture consist? And what are the essential components and how are they relevant to each other? How does the security play out? What are the best practices in formulating...