1. Wireshark LAN Monitoring HaganFox.net/NetSec Originally presented at
DeVry HackFest
(with subsequent updates and improvements)

2. Wireshark and USB Creator Vocabulary Words
OSI protocol stack * dmesg * dd * cat * partition table * master boot record * GPT * shared Ethernet * switched Ethernet * promiscuous mode * monitor mode * breakout tap * aggregating tap * hub * unmanaged switch * smart switch * managed switch * mirror port * frame * packet * SQ3R * --help * collision domain * half-duplex * full-duplex * block device * pseudo device * SPAN * Ephemeral port * Privileged port * broadcast * multicast * unicast * MAC Address * OUI * 3-Way Handshake * RST

3. IP Service Broadcast (one-to-all) Multicast (one-to-many)
Hubs could only broadcast.
Related topic: Promiscuous Mode
Multicast (one-to-many)
Special type of broadcast
Only the ports interested in receiving the traffic
Unicast (one-to-one)
Port-to-port
Full Duplex → bi-directional

4. Hubs and Switches Hubs Switches All broadcast Half-duplex
Collision domain
Switches
Efficient
Full-duplex

5. Switches Hide Packets You only see packets destined for
the port you are sniffing on.

6. Sometimes written as TAP, for
Taps
Sometimes written as TAP, for
Test Access Port

7. Taps Effective, but expensive Breakout vs Aggregating
Potential point of failure
Passively probe*
(*) Sometimes passive taps allow injection of TCP resets.

8. Switches Enterprise: e.g. Cisco SPAN Ports SMB: Mirrored Ports
(Switched Port Analyzer)
SMB: Mirrored Ports

9. Types of Switches Unmanaged Low-end Smart Premium Smart Fully Managed
Not helpful for sniffing
Low-end Smart
Helpful, Insecure
Premium Smart
Some security Features
Fully Managed
Powerful, with security features

10. Bandwidth Limitations Aggregating taps and mirror ports
are two-into-one*.
2 (RX&TX) → 1 (only TX)
Not a problem when your switch
is Gigabit and your Internet connection
Is 100 megabit.
(*) or many-into-one for a monitoring port

11. Packets will reach... A Host Running Wireshark A Single Host
(Learn.)
A Single Host
(Scrutinize a device.)
→ LAN Ingress / Egress Traffic ← (Watch for suspicious traffic going in and out.)
All LAN Ports
(It's too much and not necessary.)

12. Monitoring a Single Device

13. Monitoring
Ingress / Egress
Traffic

14. A Wireshark-Monitored LAN

16. Q & A

17. Wireshark
LAN Monitoring
HaganFox.net/NetSec