EDITION2ND DON’TDON’T JUSTJUST STARESTARE ATAT CAPTUREDCAPTURED Download the capture files used in this book from PACKETS. EDITION PACKETS. http://nostarch.com/packet2.htm 2ND PRACTICALPRACTICAL ANALYZEANALYZE THEM.THEM. PACKETPACKET ANALYSISANALYSIS PRACTICAL PACKET ANALYSIS PRACTICAL PACKET ANALYSIS USING WIRESHARK TO SOLVE REAL-WORLD NETWORK PROBLEMS It’s easy to capture packets with Wireshark, the world’s • Graph traffic patterns to visualize the data flowing most popular network sniffer, whether off the wire or from across your network the air. But how do you use those packets to understand • Use advanced Wireshark features to understand what’s happening on your network? CHRIS SANDERS confusing captures With an expanded discussion of network protocols and 45 • Build statistics and reports to help you better explain completely new scenarios, this extensively revised second technical network information to non-techies edition of the best-selling Practical Packet Analysis will teach you how to make sense of your PCAP data. You’ll Practical Packet Analysis is a must for any network find new sections on troubleshooting slow networks and technician, administrator, or engineer. Stop guessing and packet analysis for security to help you better understand start troubleshooting the problems on your network. how modern exploits and malware behave at the packet ABOUT THE AUTHOR level. Add to this a thorough introduction to the TCP/IP network stack and you’re on your way to packet analysis Chris Sanders is a computer security consultant, author, proficiency. and researcher. A SANS Mentor who holds several industry certifications, including CISSP, GCIA, GCIH, and Learn how to: GREM, he writes regularly for WindowSecurity.com and • Use packet analysis to identify and resolve common his blog, ChrisSanders.org. Sanders uses Wireshark daily network problems like loss of connectivity, DNS issues, for packet analysis. He lives in Charleston, South Carolina, sluggish speeds, and malware infections where he works as a government defense contractor. • Build customized capture and display filters All of the author’s royalties from this book • Monitor your network in real-time and tap live will be donated to the Rural Technology Fund network communications (http://ruraltechfund.org). THE FINEST IN GEEK ENTERTAINMENT™ SANDERS www.nostarch.com $49.95 ($57.95 CDN) “I LIE FLAT.” NETWORKING/SECURITY SHELVE IN: This book uses a lay-flat binding that won’t snap shut. FSC LOGO PRAISE FOR THE FIRST EDITION OF PRACTICAL PACKET ANALYSIS “An essential book if you are responsible for network administration on any level.” —LINUX PRO MAGAZINE “A wonderful, simple to use and well laid out guide.” —ARSGEEK.COM “If you need to get the basics of packet analysis down pat, this is a very good place to start.” —STATEOFSECURITY.COM “Very informative and held up to the key word in its title, ‘Practical.’ It does a great job of giving readers what they need to know to do packet analysis and then jumps right in with vivid real life examples of what to do with Wireshark.” —LINUXSECURITY.COM “Are there unknown hosts chatting away with each other? Is my machine talking to strangers? You need a packet sniffer to really find the answers to these questions. Wireshark is one of the best tools to do this job and this book is one of the best ways to learn about that tool.” —FREE SOFTWARE MAGAZINE “Perfect for the beginner to intermediate.” —DAEMON NEWS PRACTICAL PACKET ANALYSIS 2ND EDITION Using Wireshark to Solve Real-World Network Problems by Chris Sanders San Francisco PRACTICAL PACKET ANALYSIS, 2ND EDITION. Copyright © 2011 by Chris Sanders. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. Printed in Canada 15 14 13 12 11 1 2 3 4 5 6 7 8 9 ISBN-10: 1-59327-266-9 ISBN-13: 978-1-59327-266-1 Publisher: William Pollock Production Editor: Alison Law Cover and Interior Design: Octopod Studios Developmental Editor: William Pollock Technical Reviewer: Tyler Reguly Copyeditor: Marilyn Smith Compositor: Susan Glinert Stevens Proofreader: Ward Webber Indexer: Nancy Guenther For information on book distributors or translations, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 38 Ringold Street, San Francisco, CA 94103 phone: 415.863.9900; fax: 415.863.9950; [email protected]; www.nostarch.com The Library of Congress has cataloged the first edition as follows: Sanders, Chris, 1986- Practical packet analysis : using Wireshark to solve real-world network problems / Chris Sanders. p. cm. ISBN-13: 978-1-59327-149-7 ISBN-10: 1-59327-149-2 1. Computer network protocols. 2. Packet switching (Data transmission) I. Title. TK5105.55.S265 2007 004.6'6--dc22 2007013453 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. This book, my life, and everything I will ever do is a direct result of faith given and faith received. This book is dedicated to God, my parents, and everyone who has ever shown faith in me. I tell you the truth, if you have faith as small as a mustard seed, you can say to this mountain, “Move from here to there” and it will move. Nothing will be impossible for you. Matthew 17:20 BRIEF CONTENTS Acknowledgments .........................................................................................................xv Introduction ................................................................................................................xvii Chapter 1: Packet Analysis and Network Basics ................................................................1 Chapter 2: Tapping into the Wire ..................................................................................17 Chapter 3: Introduction to Wireshark ..............................................................................35 Chapter 4: Working with Captured Packets .....................................................................47 Chapter 5: Advanced Wireshark Features .......................................................................67 Chapter 6: Common Lower-Layer Protocols ......................................................................85 Chapter 7: Common Upper-Layer Protocols ...................................................................113 Chapter 8: Basic Real-World Scenarios ........................................................................133 Chapter 9: Fighting a Slow Network ............................................................................165 Chapter 10: Packet Analysis for Security .......................................................................189 Chapter 11: Wireless Packet Analysis ..........................................................................215 Appendix: Further Reading ..........................................................................................235 Index .........................................................................................................................241 CONTENTS IN DETAIL ACKNOWLEDGMENTS xv INTRODUCTION xvii Why This Book? .....................................................................................................xvii Concepts and Approach ........................................................................................xviii How to Use This Book ............................................................................................. xix About the Sample Capture Files ................................................................................ xx The Rural Technology Fund ....................................................................................... xx Contacting Me ........................................................................................................ xx 1 PACKET ANALYSIS AND NETWORK BASICS 1 Packet Analysis and Packet Sniffers ............................................................................. 2 Evaluating a Packet Sniffer ............................................................................ 2 How Packet Sniffers Work............................................................................. 3 How Computers Communicate.................................................................................... 4 Protocols ..................................................................................................... 4 The Seven-Layer OSI Model .......................................................................... 5 Data Encapsulation ...................................................................................... 8 Network Hardware .................................................................................... 10 Traffic Classifications