Saturday, 21 June 2014

Using Wireshark to evaluate a packet capture

The tool Wireshark is a fantastic tool for both capturing traffic and evaluating traffic. I typically capture traffic using the Linux command line tool 'tcpdump' but like to use Wireshark for evaluation. In this post I will be focusing on evaluation of packet captures.

If you can quickly view packets of interest e.g. insecure http connections you can right click on the packet and select 'Follow TCP Stream' which can quickly show you the traffic flow.

With a packet capture you have open in Wireshark there is a Filter box along the top which you can use to find packets of interest. I find the filter 'frame contains <search term>' can yield interesting results e.g.

frame contains Password
frame contains password
frame contains login
frame contains

Another method for example to ensure a password is not being sent over clear text is to in Wireshark select Edit -> Find Packet and in the resulting window :

  • Select String under Find
  • In the Filter field enter a password of interest e.g. secret
  • Under 'Search In' select 'Packet bytes'
  • Select Find

At the very bottom of the screen if you see 'No packet contained that string' all is good and your password was encrypted before being sent over the network :)

Note : this tool should not be used in a malicious way. It should only be used to ensure your own environment is safe where you have permission to run it e.g. your local network. 

No comments:

Post a Comment