Table of Contents for
Practical Packet Analysis, 3rd Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Practical Packet Analysis, 3rd Edition by Chris Sanders Published by No Starch Press, 2017
  1. Cover
  2. Practical Packet Analysis 3rd Edition
  3. Title Page
  4. Copyright Page
  5. Practical Packet Analysis 3rd Edition
  6. Brief Contents
  7. Contents in Detail
  8. Acknowledgments
  9. Introduction
  10. Chapter 1: Packet Analysis and Network Basics
  11. Chapter 2: Tapping into the Wire
  12. Chapter 3: Introduction to Wireshark
  13. Chapter 4: Working with Captured Packets
  14. Chapter 5: Advanced Wireshark Features
  15. Chapter 6: Packet Analysis on the Command Line
  16. Chapter 7: Network Layer Protocols
  17. Chapter 8: Transport Layer Protocols
  18. Chapter 9: Common Upper-Layer Protocols
  19. Chapter 10: Basic Real-World Scenarios
  20. Chapter 11: Fighting a Slow Network
  21. Chapter 12: Packet Analysis for Security
  22. Chapter 13: Wireless Packet Analysis
  23. Appendix A: Further Reading
  24. Appendix B: Navigating Packets
  25. Index
  26. The Electronic Frontier Foundation (EFF)
  27. DON’T JUST STARE AT CAPTURED PACKETS. ANALYZE THEM

Contents

  1. Cover
  2. Title Page
  3. Copyright Page
  4. Brief Contents
  5. Contents in Detail
  6. Acknowledgments
  7. Introduction
    1. Why This Book?
    2. Concepts and Approach
    3. How to Use This Book
    4. About the Sample Capture Files
    5. The Rural Technology Fund
    6. Contacting Me
  8. Chapter 1: Packet Analysis and Network Basics
    1. Packet Analysis and Packet Sniffers
      1. Evaluating a Packet Sniffer
      2. How Packet Sniffers Work
    2. How Computers Communicate
      1. Protocols
      2. The Seven-Layer OSI Model
      3. Network Hardware
    3. Traffic Classifications
      1. Broadcast Traffic
      2. Multicast Traffic
      3. Unicast Traffic
    4. Final Thoughts
  9. Chapter 2: Tapping into the Wire
    1. Living Promiscuously
    2. Sniffing Around Hubs
    3. Sniffing in a Switched Environment
      1. Port Mirroring
      2. Hubbing Out
      3. Using a Tap
      4. ARP Cache Poisoning
    4. Sniffing in a Routed Environment
    5. Sniffer Placement in Practice
  10. Chapter 3: Introduction to Wireshark
    1. A Brief History of Wireshark
    2. The Benefits of Wireshark
    3. Installing Wireshark
      1. Installing on Windows Systems
      2. Installing on Linux Systems
      3. Installing on OS X Systems
    4. Wireshark Fundamentals
      1. Your First Packet Capture
      2. Wireshark’s Main Window
      3. Wireshark Preferences
      4. Packet Color Coding
    5. Configuration Files
    6. Configuration Profiles
  11. Chapter 4: Working with Captured Packets
    1. Working with Capture Files
      1. Saving and Exporting Capture Files
      2. Merging Capture Files
    2. Working with Packets
      1. Finding Packets
      2. Marking Packets
      3. Printing Packets
    3. Setting Time Display Formats and References
      1. Time Display Formats
      2. Packet Time Referencing
      3. Time Shifting
    4. Setting Capture Options
      1. Input Tab
      2. Output Tab
      3. Options Tab
    5. Using Filters
      1. Capture Filters
      2. Display Filters
      3. Saving Filters
      4. Adding Display Filters to a Toolbar
  12. Chapter 5: Advanced Wireshark Features
    1. Endpoints and Network Conversations
      1. Viewing Endpoint Statistics
      2. Viewing Network Conversations
      3. Identifying Top Talkers with Endpoints and Conversations
    2. Protocol Hierarchy Statistics
    3. Name Resolution
      1. Enabling Name Resolution
      2. Potential Drawbacks to Name Resolution
      3. Using a Custom hosts File
      4. Manually Initiated Name Resolution
    4. Protocol Dissection
      1. Changing the Dissector
      2. Viewing Dissector Source Code
    5. Following Streams
      1. Following SSL Streams
    6. Packet Lengths
    7. Graphing
      1. Viewing IO Graphs
      2. Round-Trip Time Graphing
      3. Flow Graphing
    8. Expert Information
  13. Chapter 6: Packet Analysis on the Command Line
    1. Installing TShark
    2. Installing tcpdump
    3. Capturing and Saving Packets
    4. Manipulating Output
    5. Name Resolution
    6. Applying Filters
    7. Time Display Formats in TShark
    8. Summary Statistics in TShark
    9. Comparing TShark and tcpdump
  14. Chapter 7: Network Layer Protocols
    1. Address Resolution Protocol (ARP)
      1. ARP Packet Structure
      2. Packet 1: ARP Request
      3. Packet 2: ARP Response
      4. Gratuitous ARP
    2. Internet Protocol (IP)
      1. Internet Protocol Version 4 (IPv4)
      2. Internet Protocol Version 6 (IPv6)
    3. Internet Control Message Protocol (ICMP)
      1. ICMP Packet Structure
      2. ICMP Types and Messages
      3. Echo Requests and Responses
      4. traceroute
      5. ICMP Version 6 (ICMPv6)
  15. Chapter 8: Transport Layer Protocols
    1. Transmission Control Protocol (TCP)
      1. TCP Packet Structure
      2. TCP Ports
      3. The TCP Three-Way Handshake
      4. TCP Teardown
      5. TCP Resets
    2. User Datagram Protocol (UDP)
      1. UDP Packet Structure
  16. Chapter 9: Common Upper-Layer Protocols
    1. Dynamic Host Configuration Protocol (DHCP)
      1. DHCP Packet Structure
      2. The DHCP Initialization Process
      3. DHCP In-Lease Renewal
      4. DHCP Options and Message Types
      5. DHCP Version 6 (DHCPv6)
    2. Domain Name System (DNS)
      1. DNS Packet Structure
      2. A Simple DNS Query
      3. DNS Question Types
      4. DNS Recursion
      5. DNS Zone Transfers
    3. Hypertext Transfer Protocol (HTTP)
      1. Browsing with HTTP
      2. Posting Data with HTTP
    4. Simple Mail Transfer Protocol (SMTP)
      1. Sending and Receiving Email
      2. Tracking an Email Message
      3. Sending Attachments via SMTP
    5. Final Thoughts
  17. Chapter 10: Basic Real-World Scenarios
    1. Missing Web Content
      1. Tapping into the Wire
      2. Analysis
      3. Lessons Learned
    2. Unresponsive Weather Service
      1. Tapping into the Wire
      2. Analysis
      3. Lessons Learned
    3. No Internet Access
      1. Gateway Configuration Problems
      2. Unwanted Redirection
      3. Upstream Problems
    4. Inconsistent Printer
      1. Tapping into the Wire
      2. Analysis
      3. Lessons Learned
    5. No Branch Office Connectivity
      1. Tapping into the Wire
      2. Analysis
      3. Lessons Learned
    6. Software Data Corruption
      1. Tapping into the Wire
      2. Analysis
      3. Lessons Learned
    7. Final Thoughts
  18. Chapter 11: Fighting a Slow Network
    1. TCP Error-Recovery Features
      1. TCP Retransmissions
      2. TCP Duplicate Acknowledgments and Fast Retransmissions
    2. TCP Flow Control
      1. Adjusting the Window Size
      2. Halting Data Flow with a Zero Window Notification
      3. The TCP Sliding Window in Practice
    3. Learning from TCP Error-Control and Flow-Control Packets
    4. Locating the Source of High Latency
      1. Normal Communications
      2. Slow Communications: Wire Latency
      3. Slow Communications: Client Latency
      4. Slow Communications: Server Latency
      5. Latency Locating Framework
    5. Network Baselining
      1. Site Baseline
      2. Host Baseline
      3. Application Baseline
      4. Additional Notes on Baselines
    6. Final Thoughts
  19. Chapter 12: Packet Analysis for Security
    1. Reconnaissance
      1. SYN Scan
      2. Operating System Fingerprinting
    2. Traffic Manipulation
      1. ARP Cache Poisoning
      2. Session Hijacking
    3. Malware
      1. Operation Aurora
      2. Remote-Access Trojan
    4. Exploit Kit and Ransomware
    5. Final Thoughts
  20. Chapter 13: Wireless Packet Analysis
    1. Physical Considerations
      1. Sniffing One Channel at a Time
      2. Wireless Signal Interference
      3. Detecting and Analyzing Signal Interference
    2. Wireless Card Modes
    3. Sniffing Wirelessly in Windows
      1. Configuring AirPcap
      2. Capturing Traffic with AirPcap
    4. Sniffing Wirelessly in Linux
    5. 802.11 Packet Structure
    6. Adding Wireless-Specific Columns to the Packet List Pane
    7. Wireless-Specific Filters
      1. Filtering Traffic for a Specific BSS ID
      2. Filtering Specific Wireless Packet Types
      3. Filtering a Specific Frequency
    8. Saving a Wireless Profile
    9. Wireless Security
      1. Successful WEP Authentication
      2. Failed WEP Authentication
      3. Successful WPA Authentication
      4. Failed WPA Authentication
    10. Final Thoughts
  21. Appendix A: Further Reading
    1. Packet Analysis Tools
      1. CloudShark
      2. WireEdit
      3. Cain & Abel
      4. Scapy
      5. TraceWrangler
      6. Tcpreplay
      7. NetworkMiner
      8. CapTipper
      9. ngrep
      10. libpcap
      11. Npcap
      12. hping
      13. Python
    2. Packet Analysis Resources
      1. Wireshark’s Home Page
      2. Practical Packet Analysis Online Course
      3. SANS’s Security Intrusion Detection In-Depth Course
      4. Chris Sanders’s Blog
      5. Brad Duncan’s Malware Traffic Analysis
      6. IANA’s Website
      7. W. Richard Stevens’s TCP/IP Illustrated Series
      8. The TCP/IP Guide
  22. Appendix B: Navigating Packets
    1. Packet Representation
    2. Using Packet Diagrams
    3. Navigating a Mystery Packet
    4. Final Thoughts
  23. Index
  24. The Electronic Frontier Foundation (EFF)
  25. DON’T JUST STARE AT CAPTURED PACKETS. ANALYZE THEM
  1. i
  2. ii
  3. iii
  4. iv
  5. v
  6. vi
  7. vii
  8. viii
  9. ix
  10. x
  11. xi
  12. xii
  13. xiii
  14. xiv
  15. xv
  16. xvi
  17. xvii
  18. xviii
  19. xix
  20. xx
  21. xxi
  22. xxii
  23. 1
  24. 2
  25. 3
  26. 4
  27. 5
  28. 6
  29. 7
  30. 8
  31. 9
  32. 10
  33. 11
  34. 12
  35. 13
  36. 14
  37. 15
  38. 16
  39. 17
  40. 18
  41. 19
  42. 20
  43. 21
  44. 22
  45. 23
  46. 24
  47. 25
  48. 26
  49. 27
  50. 28
  51. 29
  52. 30
  53. 31
  54. 32
  55. 33
  56. 34
  57. 35
  58. 36
  59. 37
  60. 38
  61. 39
  62. 40
  63. 41
  64. 42
  65. 43
  66. 44
  67. 45
  68. 46
  69. 47
  70. 48
  71. 49
  72. 50
  73. 51
  74. 52
  75. 53
  76. 54
  77. 55
  78. 56
  79. 57
  80. 58
  81. 59
  82. 60
  83. 61
  84. 62
  85. 63
  86. 64
  87. 65
  88. 66
  89. 67
  90. 68
  91. 69
  92. 70
  93. 71
  94. 72
  95. 73
  96. 74
  97. 75
  98. 76
  99. 77
  100. 78
  101. 79
  102. 80
  103. 81
  104. 82
  105. 83
  106. 84
  107. 85
  108. 86
  109. 87
  110. 88
  111. 89
  112. 90
  113. 91
  114. 92
  115. 93
  116. 94
  117. 95
  118. 96
  119. 97
  120. 98
  121. 99
  122. 100
  123. 101
  124. 102
  125. 103
  126. 104
  127. 105
  128. 106
  129. 107
  130. 108
  131. 109
  132. 110
  133. 111
  134. 112
  135. 113
  136. 114
  137. 115
  138. 116
  139. 117
  140. 118
  141. 119
  142. 120
  143. 121
  144. 122
  145. 123
  146. 124
  147. 125
  148. 126
  149. 127
  150. 128
  151. 129
  152. 130
  153. 131
  154. 132
  155. 133
  156. 134
  157. 135
  158. 136
  159. 137
  160. 138
  161. 139
  162. 140
  163. 141
  164. 142
  165. 143
  166. 144
  167. 145
  168. 146
  169. 147
  170. 148
  171. 149
  172. 150
  173. 151
  174. 152
  175. 153
  176. 154
  177. 155
  178. 156
  179. 157
  180. 158
  181. 159
  182. 160
  183. 161
  184. 162
  185. 163
  186. 164
  187. 165
  188. 166
  189. 167
  190. 168
  191. 169
  192. 170
  193. 171
  194. 172
  195. 173
  196. 174
  197. 175
  198. 176
  199. 177
  200. 178
  201. 179
  202. 180
  203. 181
  204. 182
  205. 183
  206. 184
  207. 185
  208. 186
  209. 187
  210. 188
  211. 189
  212. 190
  213. 191
  214. 192
  215. 193
  216. 194
  217. 195
  218. 196
  219. 197
  220. 198
  221. 199
  222. 200
  223. 201
  224. 202
  225. 203
  226. 204
  227. 205
  228. 206
  229. 207
  230. 208
  231. 209
  232. 210
  233. 211
  234. 212
  235. 213
  236. 214
  237. 215
  238. 216
  239. 217
  240. 218
  241. 219
  242. 220
  243. 221
  244. 222
  245. 223
  246. 224
  247. 225
  248. 226
  249. 227
  250. 228
  251. 229
  252. 230
  253. 231
  254. 232
  255. 233
  256. 234
  257. 235
  258. 236
  259. 237
  260. 238
  261. 239
  262. 240
  263. 241
  264. 242
  265. 243
  266. 244
  267. 245
  268. 246
  269. 247
  270. 248
  271. 249
  272. 250
  273. 251
  274. 252
  275. 253
  276. 254
  277. 255
  278. 256
  279. 257
  280. 258
  281. 259
  282. 260
  283. 261
  284. 262
  285. 263
  286. 264
  287. 265
  288. 266
  289. 267
  290. 268
  291. 269
  292. 270
  293. 271
  294. 272
  295. 273
  296. 274
  297. 275
  298. 276
  299. 277
  300. 278
  301. 279
  302. 280
  303. 281
  304. 282
  305. 283
  306. 284
  307. 285
  308. 286
  309. 287
  310. 288
  311. 289
  312. 290
  313. 291
  314. 292
  315. 293
  316. 294
  317. 295
  318. 296
  319. 297
  320. 298
  321. 299
  322. 300
  323. 301
  324. 302
  325. 303
  326. 304
  327. 305
  328. 306
  329. 307
  330. 308
  331. 309
  332. 310
  333. 311
  334. 312
  335. 313
  336. 314
  337. 315
  338. 316
  339. 317
  340. 318
  341. 319
  342. 320
  343. 321
  344. 322
  345. 323
  346. 324
  347. 325
  348. 326
  349. 327
  350. 328
  351. 329
  352. 330
  353. 331
  354. 332
  355. 333
  356. 334
  357. 335
  358. 336
  359. 337
  360. 338
  361. 339
  362. 340
  363. 341
  364. 342
  365. 343
  366. 344
  367. 345
  368. 346
  369. 347
  370. 348
Back to top