Table of Contents for
Practical Packet Analysis, 3rd Edition
Close
Version ebook
/
Retour
Practical Packet Analysis, 3rd Edition
by Chris Sanders
Published by No Starch Press, 2017
Cover
Practical Packet Analysis 3rd Edition
Title Page
Copyright Page
Practical Packet Analysis 3rd Edition
Brief Contents
Contents in Detail
Acknowledgments
Introduction
Chapter 1: Packet Analysis and Network Basics
Chapter 2: Tapping into the Wire
Chapter 3: Introduction to Wireshark
Chapter 4: Working with Captured Packets
Chapter 5: Advanced Wireshark Features
Chapter 6: Packet Analysis on the Command Line
Chapter 7: Network Layer Protocols
Chapter 8: Transport Layer Protocols
Chapter 9: Common Upper-Layer Protocols
Chapter 10: Basic Real-World Scenarios
Chapter 11: Fighting a Slow Network
Chapter 12: Packet Analysis for Security
Chapter 13: Wireless Packet Analysis
Appendix A: Further Reading
Appendix B: Navigating Packets
Index
The Electronic Frontier Foundation (EFF)
DON’T JUST STARE AT CAPTURED PACKETS. ANALYZE THEM
Contents
Cover
Title Page
Copyright Page
Brief Contents
Contents in Detail
Acknowledgments
Introduction
Why This Book?
Concepts and Approach
How to Use This Book
About the Sample Capture Files
The Rural Technology Fund
Contacting Me
Chapter 1: Packet Analysis and Network Basics
Packet Analysis and Packet Sniffers
Evaluating a Packet Sniffer
How Packet Sniffers Work
How Computers Communicate
Protocols
The Seven-Layer OSI Model
Network Hardware
Traffic Classifications
Broadcast Traffic
Multicast Traffic
Unicast Traffic
Final Thoughts
Chapter 2: Tapping into the Wire
Living Promiscuously
Sniffing Around Hubs
Sniffing in a Switched Environment
Port Mirroring
Hubbing Out
Using a Tap
ARP Cache Poisoning
Sniffing in a Routed Environment
Sniffer Placement in Practice
Chapter 3: Introduction to Wireshark
A Brief History of Wireshark
The Benefits of Wireshark
Installing Wireshark
Installing on Windows Systems
Installing on Linux Systems
Installing on OS X Systems
Wireshark Fundamentals
Your First Packet Capture
Wireshark’s Main Window
Wireshark Preferences
Packet Color Coding
Configuration Files
Configuration Profiles
Chapter 4: Working with Captured Packets
Working with Capture Files
Saving and Exporting Capture Files
Merging Capture Files
Working with Packets
Finding Packets
Marking Packets
Printing Packets
Setting Time Display Formats and References
Time Display Formats
Packet Time Referencing
Time Shifting
Setting Capture Options
Input Tab
Output Tab
Options Tab
Using Filters
Capture Filters
Display Filters
Saving Filters
Adding Display Filters to a Toolbar
Chapter 5: Advanced Wireshark Features
Endpoints and Network Conversations
Viewing Endpoint Statistics
Viewing Network Conversations
Identifying Top Talkers with Endpoints and Conversations
Protocol Hierarchy Statistics
Name Resolution
Enabling Name Resolution
Potential Drawbacks to Name Resolution
Using a Custom hosts File
Manually Initiated Name Resolution
Protocol Dissection
Changing the Dissector
Viewing Dissector Source Code
Following Streams
Following SSL Streams
Packet Lengths
Graphing
Viewing IO Graphs
Round-Trip Time Graphing
Flow Graphing
Expert Information
Chapter 6: Packet Analysis on the Command Line
Installing TShark
Installing tcpdump
Capturing and Saving Packets
Manipulating Output
Name Resolution
Applying Filters
Time Display Formats in TShark
Summary Statistics in TShark
Comparing TShark and tcpdump
Chapter 7: Network Layer Protocols
Address Resolution Protocol (ARP)
ARP Packet Structure
Packet 1: ARP Request
Packet 2: ARP Response
Gratuitous ARP
Internet Protocol (IP)
Internet Protocol Version 4 (IPv4)
Internet Protocol Version 6 (IPv6)
Internet Control Message Protocol (ICMP)
ICMP Packet Structure
ICMP Types and Messages
Echo Requests and Responses
traceroute
ICMP Version 6 (ICMPv6)
Chapter 8: Transport Layer Protocols
Transmission Control Protocol (TCP)
TCP Packet Structure
TCP Ports
The TCP Three-Way Handshake
TCP Teardown
TCP Resets
User Datagram Protocol (UDP)
UDP Packet Structure
Chapter 9: Common Upper-Layer Protocols
Dynamic Host Configuration Protocol (DHCP)
DHCP Packet Structure
The DHCP Initialization Process
DHCP In-Lease Renewal
DHCP Options and Message Types
DHCP Version 6 (DHCPv6)
Domain Name System (DNS)
DNS Packet Structure
A Simple DNS Query
DNS Question Types
DNS Recursion
DNS Zone Transfers
Hypertext Transfer Protocol (HTTP)
Browsing with HTTP
Posting Data with HTTP
Simple Mail Transfer Protocol (SMTP)
Sending and Receiving Email
Tracking an Email Message
Sending Attachments via SMTP
Final Thoughts
Chapter 10: Basic Real-World Scenarios
Missing Web Content
Tapping into the Wire
Analysis
Lessons Learned
Unresponsive Weather Service
Tapping into the Wire
Analysis
Lessons Learned
No Internet Access
Gateway Configuration Problems
Unwanted Redirection
Upstream Problems
Inconsistent Printer
Tapping into the Wire
Analysis
Lessons Learned
No Branch Office Connectivity
Tapping into the Wire
Analysis
Lessons Learned
Software Data Corruption
Tapping into the Wire
Analysis
Lessons Learned
Final Thoughts
Chapter 11: Fighting a Slow Network
TCP Error-Recovery Features
TCP Retransmissions
TCP Duplicate Acknowledgments and Fast Retransmissions
TCP Flow Control
Adjusting the Window Size
Halting Data Flow with a Zero Window Notification
The TCP Sliding Window in Practice
Learning from TCP Error-Control and Flow-Control Packets
Locating the Source of High Latency
Normal Communications
Slow Communications: Wire Latency
Slow Communications: Client Latency
Slow Communications: Server Latency
Latency Locating Framework
Network Baselining
Site Baseline
Host Baseline
Application Baseline
Additional Notes on Baselines
Final Thoughts
Chapter 12: Packet Analysis for Security
Reconnaissance
SYN Scan
Operating System Fingerprinting
Traffic Manipulation
ARP Cache Poisoning
Session Hijacking
Malware
Operation Aurora
Remote-Access Trojan
Exploit Kit and Ransomware
Final Thoughts
Chapter 13: Wireless Packet Analysis
Physical Considerations
Sniffing One Channel at a Time
Wireless Signal Interference
Detecting and Analyzing Signal Interference
Wireless Card Modes
Sniffing Wirelessly in Windows
Configuring AirPcap
Capturing Traffic with AirPcap
Sniffing Wirelessly in Linux
802.11 Packet Structure
Adding Wireless-Specific Columns to the Packet List Pane
Wireless-Specific Filters
Filtering Traffic for a Specific BSS ID
Filtering Specific Wireless Packet Types
Filtering a Specific Frequency
Saving a Wireless Profile
Wireless Security
Successful WEP Authentication
Failed WEP Authentication
Successful WPA Authentication
Failed WPA Authentication
Final Thoughts
Appendix A: Further Reading
Packet Analysis Tools
CloudShark
WireEdit
Cain & Abel
Scapy
TraceWrangler
Tcpreplay
NetworkMiner
CapTipper
ngrep
libpcap
Npcap
hping
Python
Packet Analysis Resources
Wireshark’s Home Page
Practical Packet Analysis Online Course
SANS’s Security Intrusion Detection In-Depth Course
Chris Sanders’s Blog
Brad Duncan’s Malware Traffic Analysis
IANA’s Website
W. Richard Stevens’s TCP/IP Illustrated Series
The TCP/IP Guide
Appendix B: Navigating Packets
Packet Representation
Using Packet Diagrams
Navigating a Mystery Packet
Final Thoughts
Index
The Electronic Frontier Foundation (EFF)
DON’T JUST STARE AT CAPTURED PACKETS. ANALYZE THEM
i
ii
iii
iv
v
vi
vii
viii
ix
x
xi
xii
xiii
xiv
xv
xvi
xvii
xviii
xix
xx
xxi
xxii
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348