It’s easy enough to install Wireshark and begin capturing packets off the wire—or from the air. But how do you interpret those packets once you’ve captured them? And how can those packets help you to better understand what’s going on under the hood of your network? Practical Packet Analysis shows how to use Wireshark to capture and then analyze packets as you take an in- depth look at real-world packet analysis and network troubleshooting. The way the pros do it. Wireshark (derived from the Ethereal project), has become the world’s most popular network sniffing appli- cation. But while Wireshark comes with documentation, there’s not a whole lot of information to show you how to use it in real-world scenarios. Practical Packet Analysis shows you how to: • Use packet analysis to tackle common network problems, such as loss of connectivity, slow networks, malware infections, and more • Build customized capture and display filters • Tap into live network communication www.nostarch.com “ I L AY FLAT .” This book uses RepKover—a durable binding that won’t snap shut. Printed on recycled paper TH E F I N E S T I N G E E K E NT E RTAI N M E NT ™ SHELVE IN: NETWORKING/SECURITY $39.95 ($49.95 CDN) ® D O N ’ T J U S T S T A R E A T C A P T U R E D P A C K E T S . A N A L Y Z E T H E M . D O N ’ T J U S T S T A R E A T C A P T U R E D P A C K E T S . A N A L Y Z E T H E M . • Graph traffic patterns to visualize the data flowing across your network • Use advanced Wireshark features to understand confusing packets • Build statistics and reports to help you better explain technical network information to non-technical users Because net-centric computing requires a deep under- standing of network communication at the packet level, Practical Packet Analysis is a must have for any network technician, administrator, or engineer troubleshooting network problems of any kind. A B O U T T H E A U T H O R Chris Sanders is the network administrator for the Graves County Schools in Kentucky, where he manages more than 1,800 workstations, 20 servers, and a user base of nearly 5,000. His website, ChrisSanders.org, offers tutorials, guides, and technical commentary, including the very popular Packet School 101. He is also a staff writer for WindowsNetworking.com and WindowsDevCenter.com. He uses Wireshark for packet analysis almost daily. T E C H NI C A L R E V I E W B Y G E R A L D C O M B S, C R E A T O R O F W I R E S H A R K T E C H N I C A L R E V I E W B Y G E R A L D C O M B S , C R E A T O R O F W I R E S H A R K Download the capture files used in this book from www.nostarch.com/packet.htm PR AC T IC A L PACKE T A N A LYSIS PR AC T IC A L PACKE T A N A LYSIS U S I N G W I R E S H A R K T O S O L V E R E A L - W O R L D N E T W O R K P R O B L E M S C H R I S S A N D E R S ® P R A C T I C A L PAC K E T A N A LY S I S P R A C T I C A L PAC K E T A N A LY S I S S A N D E R S Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com PRACTICAL PACKET ANALYSIS Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com PRACTICAL PACKET ANALYSIS Using Wireshark to Solve Real-World Network Problems by Chris Sanders San Francisco ® Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com PRACTICAL PACKET ANALYSIS. Copyright © 2007 by Chris Sanders. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. 11 10 09 08 07 1 2 3 4 5 6 7 8 9 ISBN-10: 1-59327-149-2 ISBN-13: 978-1-59327-149-7 Publisher: William Pollock Production Editor: Christina Samuell Cover and Interior Design: Octopod Studios Developmental Editor: William Pollock Technical Reviewer: Gerald Combs Copyeditor: Megan Dunchak Compositor: Riley Hoffman Proofreader: Elizabeth Campbell Indexer: Nancy Guenther For information on book distributors or translations, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 555 De Haro Street, Suite 250, San Francisco, CA 94107 phone: 415.863.9900; fax: 415.863.9950; info@nostarch.com; www.nostarch.com Library of Congress Cataloging-in-Publication Data Sanders, Chris, 1986- Practical packet analysis : using Wireshark to solve real-world network problems / Chris Sanders. p. cm. ISBN-13: 978-1-59327-149-7 ISBN-10: 1-59327-149-2 1. Computer network protocols. 2. Packet switching (Data transmission) I. Title. TK5105.55.S265 2007 004.6'6 dc22 2007013453 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. Printed on recycled paper in the United States of America Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com This book is dedicated to my parents, who bought the first computer I ever programmed. Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com BRIEF CONTENTS Acknowledgments xv Introduction xvii Chapter 1: Packet Analysis and Network Basics 1 Chapter 2: Tapping into the Wire 15 Chapter 3: Introduction to Wireshark 27 Chapter 4: Working with Captured Packets 39 Chapter 5: Advanced Wireshark Features 51 Chapter 6: Common Protocols 61 Chapter 7: Basic Case Scenarios 77 Chapter 8: Fighting a Slow Network 99 Chapter 9: Security-based Analysis 121 Chapter 10: Sniffing into Thin Air 135 Chapter 11: Further Reading 151 Afterword 154 Index 155 Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com [...]... Analysis? Packet analysis, often referred to as packet sniffing or protocol analysis, describes the process of capturing and interpreting live data as it flows across a network in order to better understand what is happening on that network Packet analysis is typically performed by a packet sniffer, a tool used to capture raw network data going across the wire Packet analysis can help us understand network. .. learn how to use the features of the Wireshark packet analysis tool to tackle slow network communication, identify application bottlenecks, and even track hackers through some real-world scenarios By the time you have finished reading this book, you should be able to implement advanced packet analysis techniques that will help you solve even the most difficult problems in your own network What Is Packet. .. of common languages called network protocols that govern network communication Common network protocols include TCP, IP, ARP, and DHCP A protocol stack is a logical grouping of protocols that work together A network protocol can be extremely simple or highly complex, depending on its function Although the various network protocols are often drastically different, most have to address the following issues:... http://www.simpopdf.com 1 PACKET ANALYSIS AND NETWORK BASICS A million different things can go wrong with a computer network on any given day—from a simple spyware infection to a complex router configuration error—and it is impossible to solve every problem immediately The best we can hope to do is be fully prepared with the knowledge and the tools it takes to respond to these types of issues All network problems stem... understand packet analysis and Wireshark The second half of the book is devoted entirely to practical case scenarios that you could easily encounter in dayto-day network management Whether you are a network technician, a network administrator, a chief information officer, a desktop technician, or simply a help desk worker, you have a lot to gain from understanding and using packet analysis techniques Concepts... there are no secrets, and the more we can do at the packet level, the more we can control our network and solve problems This is the world of packet analysis This book dives into the world of packet analysis headfirst You’ll learn what packet analysis is before we delve into network communication, so you can gain some of the basic background you’ll need to examine different Simpo PDF Merge and Split Unregistered... very basics of network communication and packet analysis Chapter 2: Tapping into the Wire This chapter covers the different techniques you can use to place a packet sniffer on your network xviii In t ro duc ti on Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Chapter 3: Introduction to Wireshark Here we’ll look at the basics of Wireshark where to get it, how to use it, what... involve a limited amount of analysis— just enough to get your feet wet Chapter 8: Fighting a Slow Network The most common problems network technicians hear about generally involve slow network performance This chapter is devoted to solving these types of problems Chapter 9: Security-based Analysis Network security is the biggest hot-button topic in network administration Because of this, Chapter 9... opposed to any other book about packet analysis The answer lies right in the title: Practical Packet Analysis Let’s face it—nothing beats real-world experience, and the closest you can come to that experience in a book is through practical examples of packet analysis with real-world case scenarios The first half of this book gives you the prerequisite knowledge you will need to understand packet analysis... the operating systems that you need to support How Packet Sniffers Work The packet sniffing process can be broken down into three steps: collection, conversion, and analysis Collection In the first step, the packet sniffer switches the selected network interface into promiscuous mode In this mode the network card can listen for all network traffic on its particular network segment The sniffer uses this . to show you how to use it in real-world scenarios. Practical Packet Analysis shows you how to: • Use packet analysis to tackle common network problems, such as loss of connectivity, slow networks,. 1986- Practical packet analysis : using Wireshark to solve real-world network problems / Chris Sanders. p. cm. ISBN-13: 978-1-59327-149-7 ISBN-10: 1-59327-149-2 1. Computer network protocols the hood of your network? Practical Packet Analysis shows how to use Wireshark to capture and then analyze packets as you take an in- depth look at real-world packet analysis and network troubleshooting.