- 138 pages
- English
- ePUB (mobile friendly)
- Available on iOS & Android
eBook - ePub
Wireshark Network Security
About this book
If you are network administrator or a security analyst with an interest in using Wireshark for security analysis, then this is the book for you. Basic familiarity with common network and application services terms and technologies is assumed.
Tools to learn more effectively
Saving Books
Keyword Search
Annotating Text
Listen to it instead
Information
Wireshark Network Security
Table of Contents
Wireshark Network Security
Credits
About the Author
Acknowledgment
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers, and more
Why subscribe?
Free access for Packt account holders
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Downloading the color images of this book
Errata
Piracy
Questions
1. Getting Started with Wireshark – What, Why, and How?
Sniffing
The purpose of sniffing
Packet analysis
The tools of the trade
What is Wireshark?
The Wireshark interface – Before starting the capture
Title
Menu
Main toolbar
Filter toolbar
Capture frame
Capture Help
The Files menu
Online
The Status bar
First packet capture
Summary
2. Tweaking Wireshark
Filtering our way through Wireshark
Capture filters
Display filters
The list of display filters
Wireshark profiles
Creating a new profile
Essential techniques in Wireshark
The Summary window
The Protocol Hierarchy window
The Conversations window
The Endpoints window
The Expert Infos window
Wireshark command-line fu
tshark
Starting the capture
Saving the capture to a file
Using filters
Statistics
capinfos
editcap
mergecap
Summary
3. Analyzing Threats to LAN Security
Analyzing clear-text traffic
Viewing credentials in Wireshark
FTP
Telnet
HTTP
TFTP
Reassembling data stream
Case study
Examining sniffing attacks
MAC flooding
ARP poisoning
Analyzing network reconnaissance techniques
Examining network scanning activities
Detect the scanning activity for live machines
Ping sweep
ARP sweep
Identify port scanning attempts
A TCP Connect scan
Wireshark's Flow Graph
Wireshark's Expert Info
Wireshark's Conversations
Stealth scan
Wireshark's Flow Graph
Wireshark's Expert Info
Wireshark's Conversations
NULL scan
UDP scan
Other scanning attempts
ACK scan
IP Protocol scan
OS fingerprinting attempts
Detect password cracking attempts
Brute-force attacks
Identifying POP3 password cracking
HTTP basic authentication
Dictionary-based attacks
Detecting FTP password cracking
Miscellaneous attacks
FTP bounce attack
DNS zone transfer
SSL stripping attack
Complementary tools to Wireshark
Xplico
Sysdig
Pcap2XML
SSHFlow
Important display filters
Filters based on protocols
DNS
FTP
HTTP
Filters based on unique signatures and regular expressions
Regular expressions
Nailing the CTF challenge
Summary
4. Probing E-mail Communications
E-mail forensics challenges
Challenge 1 – Normal login session
Challenge 2 – Corporate espionage
Analyzing attacks on e-mail communications
Detecting SMTP enumeration
Using auxiliary module in Metasploit
Analyzing SMTP relay attack
Important filters
Summary
5. Inspecting Malware Traffic
Gearing up Wireshark
Updated columns
Updated coloring rules
Important display filters
Malicious traffic analysis
Case study – Blackhole exploit kit
Protocols in action
The IP address of the infected box
Any unusual port number
A compromised website
Infected file(s)
Conclusion
IRC botnet(s)
Inspection
Summary
6. Network Performance Analysis
Creating a custom profile for troubleshooting
Optimization before analysis
TCP-based issues
Case study 1 – Slow Internet
Analysis
Case study 2 – Sluggish downloads
Analysis
Case study 3 – Denial of Service
SYN flood
Summary
Index
Wireshark Network Security
Copyright © 2015 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caus...
Table of contents
- Wireshark Network Security
Frequently asked questions
Yes, you can cancel anytime from the Subscription tab in your account settings on the Perlego website. Your subscription will stay active until the end of your current billing period. Learn how to cancel your subscription
No, books cannot be downloaded as external files, such as PDFs, for use outside of Perlego. However, you can download books within the Perlego app for offline reading on mobile or tablet. Learn how to download books offline
Perlego offers two plans: Essential and Complete
- Essential is ideal for learners and professionals who enjoy exploring a wide range of subjects. Access the Essential Library with 800,000+ trusted titles and best-sellers across business, personal growth, and the humanities. Includes unlimited reading time and Standard Read Aloud voice.
- Complete: Perfect for advanced learners and researchers needing full, unrestricted access. Unlock 1.4M+ books across hundreds of subjects, including academic and specialized titles. The Complete Plan also includes advanced features like Premium Read Aloud and Research Assistant.
We are an online textbook subscription service, where you can get access to an entire online library for less than the price of a single book per month. With over 1 million books across 990+ topics, we’ve got you covered! Learn about our mission
Look out for the read-aloud symbol on your next book to see if you can listen to it. The read-aloud tool reads text aloud for you, highlighting the text as it is being read. You can pause it, speed it up and slow it down. Learn more about Read Aloud
Yes! You can use the Perlego app on both iOS and Android devices to read anytime, anywhere — even offline. Perfect for commutes or when you’re on the go.
Please note we cannot support devices running on iOS 13 and Android 7 or earlier. Learn more about using the app
Please note we cannot support devices running on iOS 13 and Android 7 or earlier. Learn more about using the app
Yes, you can access Wireshark Network Security by Piyush Verma in PDF and/or ePUB format, as well as other popular books in Computer Science & Cyber Security. We have over one million books available in our catalogue for you to explore.