SCOTT SIDEL'S DOWNLOADS
Wireshark: Taking a bite out of packet analysis
Scott Sidel
02.16.2007
Rating: --- (out of 5)
|
Whether you need to get inside of a packet, either to diagnose a problem or to root out suspicious behavior, this month's tool is for you. Wireshark, formerly known as Ethereal, offers a polished interface and industrial strength capabilities, plus it's as good as any packet sniffer that costs thousands of dollars.
Packet capture provides information about network data packets, such as the transmit time, source, destination, protocol type (TCP, IGMP or HTTP) and "header" data such as sequence and acknowledgements. Wireshark will typically display information in three panels: the transmission overview, packet details and a pane showing raw hex.
If you need to see what is inside the packets, you're going to have to plug a host into the network somewhere along the path traversed by the packets. And while most network cards ignore packets not addressed to them, Wireshark places the interface it's capturing in promiscuous mode.
On a side note, Windows users will need to install a driver called WinPcap that has administrator privileges in order to provide packet capture capabilities not built into the OS.
Wireshark can read hundreds of protocols, which can provide a deluge of data. Viewing the raw information has
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
its benefits, but users can opt to filter and parse the captured data using a mouse click interface to create Boolean filters. Users can also create and save filters for later use. Wireshark supports built-in searches to hone in on specific data or conditions, and will even build I/O graphs to show usage by packet type.
Its output can be exported for use by a variety of popular network analysis products, including: WildPackets Inc.'s EtherPeek and AiroPeek products, Cisco Systems Inc.'s Secure Intrusion Detection System, Microsoft's Network Monitor, Network General Corp.'s Sniffer, Novell Inc.'s LANalyzer, and various other tools using tcpdump's capture format including snoop and libpcap.
Wireshark is currently available for Windows and Linux, and has been ported to Mac OS X and Sun Solaris. It is licensed under the GNU General Public License and therefore can be used both privately and in a business environment. But this goes without saying: remember to get your company's or client's permission first!
Read Sidel's previous review: Snort: A capable network intrusion prevention tool
About the author:
Scott Sidel, CISSP, is an Information Systems Security Officer (ISSO) for Lockheed Martin.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
