[Wireshark]Cyber security analysis and identify common cyber network attacks

overview

We will cover the basics of Wireshark first, then you’ll gain the ability to threat hunt at the packet level.

capture traffic and examine the packet

• open Wireshark and choose Ethernet

• you can check capture options

• let’s generate some traffic

• Use filter to find the related IP address

ip.addr == 1.1.1.1 (target IP)

/%ifconfig
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
    ether 14:9d:99:81:0a:c9 
    inet6 fe80::10c2:5ce7:5c47:1822%en0 prefixlen 64 secured scopeid 0x4 
    inet 192.168.3.9 netmask 0xffffff00 broadcast 192.168.3.255

you can see the traffic from my IP (192.168.3.9) to 1.1.1.1 and reply from 1.1.1.1 as well

they show the send and reply conversation

• you can see four sections

• frame section shows the entire message

• Ethernet section shows specific ethernet header

• shows specific IPv4 info

• specific to ICMP info

• hexadecimal values

• In the bottom, the detail info about packet

Examine the frame dissector

• start capturing
• Open Firefox and press shift + command + p to open private browser

• Go to www.pluralsight.com/teach/author-tools/veronicas-plant-nursery

once you open it, close it and stop capturing. Let’s filter now!!

frame contains veronica

This filters every packet containing the word “veronica”

• Right click > Follow > HTTP steam

you can see the detail of HTTP stream. close it.

You can see the IPv4 info is organized in Wireshark

Use Wireshark packets to map a network

Network diagram

Capturing traffic using Display filters

arp

• show all of the arp requests and reply

dns

• show all DNS requests

dns.qry.name == "www.pluralsight.com"

• show only dns query of the specific DNS query

you can see the answers section

combining multiple display filters

dns.qry.name == "www.pluralsight.com" ||dns

ip.addr eq 192.168.3.9 && ip.addr == 52.88.45.204

(ip.src == 192.168.3.9) && (ip.dst == 52.88.45.204)

you can create automated filter as well.

Foundational TCP Analysis

• Lets create a new profile from bottom right. right-click > new. Name
  “TCP plain”

• Wireshark > preferences >+ > add Delta

• Drag and drop to the position next to Time

• View > coloring rules > add TCP SYN

• statistics > conversations

we can see the statistics of TCP

• this is the largest Delta time.

ip.addr==192.168.3.9 && tcp.port==59166 && ip.addr==75.2.53.94 && tcp.port==443 && tcp.analysis.flags

tcp.analysis.flags

This shows error of tcp packet

Wireshark Configuration for Cyber Security Analysis

Creating a security profile

• right bottom > right click > new. Create a profile called security operations

• View > Time Display format > Time of Day, milliseconds

• save useful TCP setting

tcp.flags.syn==1

• view > coloring rule

So you can color traffics

The statistics view

• statistics > conversations (ports, ip, bytes)

Configure GeoIP location Resolution

• Wireshark > preferences > name resolution > MaxMind database > Edit

• write a path to MaxMind database

• statistics > endpoints > IPv4

• we can see where the traffic come from

Configure custom colums

• choose one packet > tcp > source port > right click > add as column

• you can have your own column

• right click source port and edit column > add “or udp.srcport” in the Fields

• lets right click Request URI and add column too.

Name resolutions

• Wireshark > preferences > name resolution >

exporting HTTP objects and files

• file > HTTP object export > save

• After exporting, you can upload malicious files to VirusTotal.

Filtering for unusual DNS activity

dns.flags.response == 1

• check how many responses

dns.count.answers > 10

• check answers more than 10 times

dns.flags.response == 0 and ! ip.dst == 10.0.0.0/24 (local DNS IP address)

• check the DNS query destination is not local DNS server (here pretending the local DNS server is in 10.0.0.x/24)

dns.flags.response == 1 and ip.len > 500

• DNS response which contains more than 500 bytes

Filtering for traffic based on country location

ip.geoip.dst_country == "Japan"

• filter traffic only coming from Japan

filtering for suspect TCP behavior

(tcp.flags.syn==1) && (tcp.flags.ack == 0)

• filter only Syn packet

((tcp.flags.urg == 0) && (tcp.flags.syn == 0)) && (tcp.flags.push == 0)

• filter for Xmas scan

tcp.port == 22 and ! ip.src == 10.0.0.1/24 (spcific IP that ssh is allowed)

• filter SSH that connect from strange ip address

Filtering for Executable files

http contains DOS

• right click the file > follow > TCP stream

executable file disguises

Decrypting TLS traffic

• Wireshark > preference >protocol > TLS

Identify Common Cyber Network Attacks with Wireshark

Detecting Port Scans

tcp.flags.syn == 1 and tcp.flags.ack == 1 and ip.dst == 10.0.2.15 <target IP >

• check ports responded to scans from target IP

Threat hunting: Analyzing a real netwrok and port scan

http.request or http.response

• look for “post”

check TCP stream as well

!tcp.port in {80 135 443 445 995 8000}

• check unusual ports are used or not

check TCP stream as well

MZ………………….@……………………………………… .!..L.!This program cannot be run in DOS

http.request.uri contains "png"

name is png but the content is executable file.

tcp.analysis.flags

• show all retransmission and strange TCP behavior

You can also see other Wireshark articles

[Wireshark]Network traffic analysis with Wireshark

[Project] Applying Various Filters in Wireshark