EFFECTIVELY TEACHING WITH WIRESHARK LAURA CHAPPELL EFFECTIVELY TEACHING WITH WIRESHARK LAURA CHAPPELL CHAPPELLU.COM WIRESHARKTRAINING.COM ®

2 Wireshark Techniques Wireshark Functionality and Resources The “Golden Rules” of Wireshark Analysis Key Tasks Everyone Should Learn –Capturing Wired/Wireless Traffic –Custom Profiles –Top Capture Filters –Top Display Filters –Custom Coloring Rules –Finding Problems Using Graphs –Using the Wireshark Expert

SECTION 1: WIRESHARK FUNCTIONALITY OVERVIEW

4 Capturing Traffic Network Capture FiltersWinPcap – AirPcap - libpcap Capture Engine

5 Opening Trace Files Drive Wiretap Library

6 Processing Packets Capture Engine Wiretap Library Core Engine Dissectors – Plugins – Display FiltersGTK

7 Help? Problems? Websitewww.wireshark.org Wiki Pagewiki.wireshark.org FAQwww.wireshark.org/faq.html WinPcapwww.winpcap.org Mailing Listswww.wireshark.org/lists.html Bug Trackerbugs.wireshark.org/bugzilla Q&Aask.wireshark.org

8 General Analyst Resources - Tips – (me) – Protocol Numbers – the RFCs – videos/traces – lots of trace files ask.wireshark.org – got questions?

SECTION 2: THE “GOLDEN RULES” OF WIRESHARK ANALYSIS

10 Golden Rules The Golden Rules Capture as close to the complaining user/device as possible Know how to capture the packets before you need to (e.g., spanning vs. tapping and WLAN capture options) Use capture filters sparingly/display filters liberally Customize Wireshark (profiles, coloring rules, filters) Build a HOT trace file library The packets never lie – but they will not tell why something is happening

SECTION 3: THE KEY TASKS EVERYONE SHOULD MASTER

12 Let’s Go Live Now Capturing Wired/Wireless Traffic Using Profiles Hot Capture Filters Hot Display Filters Using Coloring Rules Finding Problems Using Graphs Using the Wireshark Expert

13 Wireless Traffic Capture You must have a promiscuous and monitor mode adapter Check out AirPcap Adapters (

14 WLAN OS/Driver Issues Display Filter Capture Filter Promiscuous Mode Monitor Mode (rfmon mode) Signal Promiscuous Mode = Monitor Mode Promiscuous Mode = Monitor Mode

Port Spanning or Mirroring Visibility Span port #3 to port #1 port #1 port #3

16 Full Duplex Links iTap GigaBit Copper Dual Port Aggregator 10/100BaseT Dual Port Aggregator Tap 10/100BaseT Port Aggregator Tap Visibility Server

17 Using Profiles Custom preferences, capture/display filters and coloring rules Sample: WLAN Profile

18 Capture Filters Network Capture Filters WinPcap – AirPcap - LibPcap Capture Engine

19 Hot Capture Filters host port 67 (TCP or UDP) tcp port 80 ether host 00:08:15:00:08:15 (my MAC) not ether host 00:08:15:00:08:15 (not me) wlan host 00:2A:4B:23:36:2A

20 Hot Display Filters ip.addr == /16 !ip.addr == /16 (don’t use !=) tcp.analysis.flags wlan.fc.type_subtype ==8 (beacons only) http.response.code > 399 (HTTP errors) tcp.options contains 01:01:01:01 (ASA issue) ftp.response.arg == "Login incorrect."

21 Using Coloring Rules Consider disabling Checksum Errors Consider disabling Checksum Errors

22 Finding Problems with Graphs IO Graph – click on dips Advanced IO Graph – count tcp.analysis.retransmissions, etc. TCP Time/Sequence Graph RTT Graph – client’s perspective Oh… and use Endpoint Statistics to determine top talkers

23 Graph Delays and Errors

24 Always Check the Expert

WRAP-UP