π Quick Study Guide: Wireshark for Network Forensics
- π‘ What is Wireshark? A free, open-source packet analyzer used for network troubleshooting, analysis, software and communications protocol development, and security.
- π Forensic Application: Captures and analyzes network traffic to identify suspicious activities, malware communication, data exfiltration, reconnaissance, and other security incidents.
- π‘οΈ Key Features & Techniques:
- π Packet Capture: Intercepts data packets traveling over a network.
- π¨ Display Filters: Powerful filtering capabilities to narrow down traffic (e.g.,
ip.addr == 192.168.1.1, tcp.port == 80, http.request).
- π Protocol Hierarchy Statistics: Shows the distribution of protocols in a capture.
- π οΈ Follow TCP/UDP Stream: Reconstructs the data stream of a specific conversation, useful for seeing application layer data.
- π΅οΈββοΈ Expert Information: Wireshark's built-in analysis that highlights potential issues (warnings, errors).
- π¨ Identifying Threats (Real-World Examples):
- π« DDoS Attacks: Look for unusually high volumes of traffic from many sources to a single destination, often with specific flags or malformed packets. Filters:
tcp.flags.syn == 1 && tcp.flags.ack == 0 for SYN floods.
- π¦ Malware Command & Control (C2): Detect unusual outbound connections to unknown IPs, repetitive beaconing, non-standard ports, or suspicious DNS queries. Filters:
dns.qry.name contains "maliciousdomain.com" or specific port numbers.
- π€ Data Exfiltration: Identify large outbound data transfers to external, unauthorized destinations, especially over common ports like HTTP/HTTPS or DNS tunneling. Filters:
http.request.method == "POST" && ip.src == internal_ip && ip.dst != internal_ip (looking for large uploads).
- π΅οΈββοΈ Reconnaissance (Port Scanning): Look for many connection attempts to different ports on a target system from a single source. Filters:
tcp.flags.syn == 1 && tcp.flags.ack == 0 && !tcp.flags.rst == 1 (many SYN packets without ACKs/RSTs).
- π£ Phishing Attempts: Analyze email traffic (if captured) for suspicious links or attachments. While Wireshark won't open emails, it can show HTTP requests to suspicious URLs.
π Practice Quiz
-
Which Wireshark filter would you use to identify potential SYN flood attack attempts against a server at IP 192.168.1.100?
A. ip.dst == 192.168.1.100 && tcp.flags.syn == 1 && tcp.flags.ack == 1
B. ip.dst == 192.168.1.100 && tcp.flags.syn == 1 && tcp.flags.ack == 0
C. ip.src == 192.168.1.100 && tcp.flags.syn == 1
D. ip.addr == 192.168.1.100 && tcp.port == 80
-
When investigating a potential data exfiltration incident, which Wireshark feature would be most useful for reconstructing the actual data transferred over a TCP connection?
A. Protocol Hierarchy Statistics
B. I/O Graphs
C. Follow TCP Stream
D. Expert Information
-
A network forensic analyst observes repeated, small outbound connections to an unknown external IP address on non-standard ports. This pattern is most indicative of:
A. A legitimate software update
B. A Denial-of-Service (DoS) attack
C. Malware Command & Control (C2) communication
D. A port scan against the internal network
-
You suspect an internal host (10.0.0.5) is performing reconnaissance by scanning other internal hosts. Which filter could help you identify this activity?
A. ip.src == 10.0.0.5 && tcp.flags.syn == 1 && tcp.flags.ack == 1
B. ip.src == 10.0.0.5 && tcp.flags.syn == 1 && tcp.flags.ack == 0 && !tcp.flags.rst == 1
C. ip.dst == 10.0.0.5 && http.request
D. ip.addr == 10.0.0.5 && udp.port == 53
-
Which type of information would typically NOT be directly visible or easily reconstructed from a standard Wireshark packet capture without additional tools?
A. The content of unencrypted HTTP requests
B. The source and destination IP addresses of network traffic
C. The full content of an encrypted HTTPS session
D. The ports used by a specific application
-
A high volume of ICMP Echo Request packets (ping) originating from multiple external sources targeting a single internal server might indicate:
A. Normal network monitoring activity
B. A Smurf attack (type of DDoS)
C. A legitimate VPN connection
D. A successful data exfiltration
-
In Wireshark, what does the "Expert Information" panel primarily help a forensic analyst with?
A. Generating custom scripts for automated analysis.
B. Providing high-level summaries and highlighting potential network problems or anomalies.
C. Decrypting encrypted traffic without prior knowledge of keys.
D. Directly blocking malicious IP addresses.
Click to see Answers
1. B. ip.dst == 192.168.1.100 && tcp.flags.syn == 1 && tcp.flags.ack == 0 (A SYN flood is characterized by many SYN packets to a target without a corresponding ACK, indicating incomplete handshakes.)
2. C. Follow TCP Stream (This feature reconstructs the entire conversation payload, allowing you to see the application-layer data exchanged.)
3. C. Malware Command & Control (C2) communication (Malware often uses small, frequent "beaconing" connections to its C2 server, sometimes on unusual ports, to check for commands.)
4. B. ip.src == 10.0.0.5 && tcp.flags.syn == 1 && tcp.flags.ack == 0 && !tcp.flags.rst == 1 (A port scan involves sending SYN packets to various ports; a lack of ACKs or RSTs indicates an open port or no response, characteristic of scanning.)
5. C. The full content of an encrypted HTTPS session (Wireshark can see the encrypted packets, but without the server's private key, it cannot decrypt the content of HTTPS traffic.)
6. B. A Smurf attack (type of DDoS) (A Smurf attack uses ICMP Echo Requests directed at a broadcast address to amplify traffic to a victim, though modern networks mitigate this.)
7. B. Providing high-level summaries and highlighting potential network problems or anomalies. (Expert Information flags things like retransmissions, out-of-order packets, or potential application errors, which can be crucial for forensic analysis.)