Learn Wireshark: A definitive guide to expertly analyzing protocols and troubleshooting networks using Wireshark Lisa Bock 2024 scribd download
Learn Wireshark: A definitive guide to expertly analyzing protocols and troubleshooting networks using Wireshark Lisa Bock 2024 scribd download
com
https://textbookfull.com/product/learn-wireshark-a-
definitive-guide-to-expertly-analyzing-protocols-and-
troubleshooting-networks-using-wireshark-lisa-bock/
OR CLICK BUTTON
DOWNLOAD NOW
https://textbookfull.com/product/practical-packet-analysis-using-
wireshark-to-solve-real-world-network-proble-3rd-edition-safari/
textboxfull.com
https://textbookfull.com/product/a-guide-to-software-managing-
maintaining-and-troubleshooting-jean-andrews/
textboxfull.com
https://textbookfull.com/product/learn-data-science-using-sas-studio-
a-quick-start-guide-engy-fouda/
textboxfull.com
Troubleshooting Electronic Circuits: A Guide to Learning
Analog Electronics 1st Edition Ronald Quan
https://textbookfull.com/product/troubleshooting-electronic-circuits-
a-guide-to-learning-analog-electronics-1st-edition-ronald-quan/
textboxfull.com
https://textbookfull.com/product/programming-mathematics-using-
matlab-1st-edition-lisa-a-oberbroeckling/
textboxfull.com
https://textbookfull.com/product/programming-mathematics-using-
matlab-1st-edition-oberbroeckling-lisa-a/
textboxfull.com
https://textbookfull.com/product/programming-mathematics-using-
matlab-1st-edition-oberbroeckling-lisa-a-2/
textboxfull.com
Learn Wireshark
Second Edition
Lisa Bock
BIRMINGHAM—MUMBAI
Learn Wireshark
Second Edition
Copyright © 2022 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means, without the prior written permission of the publisher,
except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the
information presented. However, the information contained in this book is sold without warranty,
either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors,
will be held liable for any damages caused or alleged to have been caused directly or indirectly by
this book.
Packt Publishing has endeavored to provide trademark information about all of the companies
and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing
cannot guarantee the accuracy of this information.
ISBN 978-1-80323-167-9
www.packt.com
To all dreamers, know that there isn't always a clear path to achieving your dream.
In addition to celebrating and rejoicing each milestone, there will be times of
great sorrow and despair along the way. Nonetheless, keep moving toward your
dream while being authentic, harmonious, and true to yourself. One day you'll
see a sign, and you'll say to yourself with a smile, "I have arrived."
Contributors
About the author
Lisa Bock is an experienced author with a demonstrated history of working in the
e-learning industry. She is a security ambassador with a broad range of IT skills and
knowledge, including Cisco security, CyberOps, Wireshark, biometrics, ethical hacking,
and the IoT. Lisa is an author for LinkedIn Learning and an award-winning speaker who
has presented at several national conferences. She holds an MS in computer information
systems/information assurance from UMGC. Lisa was an associate professor in the IT
department at Pennsylvania College of Technology (Williamsport, PA) from 2003 until
her retirement in 2020. She is involved with various volunteer activities, and she and her
husband, Mike, enjoy bike riding, watching movies, and traveling.
I'd like to thank the author, Lisa Bock, and the team at Packt for giving me
the opportunity to do something that has been wholly enjoyable – reviewing
this great book. Most thanks, however, go to my long-suffering family and
colleagues for giving me the time and support to do so. Thank you, Chris,
Bryn, Jon, Caroline, Craig, and everybody else. You're brilliant.
Table of Contents
Preface
2
Using Wireshark
Examining the Finding information 34
Wireshark interface 28
Understanding the phases of
Streamlining the interface 28
packet analysis 34
Discovering keyboard shortcuts 31
Gathering network traffic 34
Recognizing the Wireshark authors 32
Decoding the raw bits 37
viii Table of Contents
3
Installing Wireshark
Discovering support for Beginning the installation 58
different OSes 50 Choosing components 58
Using Wireshark on Windows 50 Creating shortcuts and selecting
Running Wireshark on Unix 50 an install location 62
Installing Wireshark on macOS 51 Capturing packets and completing
the installation 63
Deploying Wireshark on Linux 51
Working with Wireshark Reviewing available resources 65
on other systems 52
Viewing news and help topics 65
Comparing different Evaluating download options 67
capture engines 54
Summary69
Understanding libpcap 54
Questions69
Examining WinPcap 54
Grasping Npcap 55 Further reading 71
Performing a standard
Windows installation 58
4
Exploring the Wireshark Interface
Opening the Wireshark Printing packets and closing Wireshark 82
welcome screen 74
Discovering the Edit menu 84
Selecting a file 74
Copying items and finding packets 84
Capturing traffic 75
Marking or ignoring packets 88
Exploring the File menu 76 Setting a time reference 89
Opening a file, closing, and saving 77 Personalizing your work area 90
Exporting packets, bytes, and objects 78
Exploring the View menu 91
Table of Contents ix
6
Personalizing the Interface
Personalizing the layout 130 Adding, editing, and deleting columns 141
Altering the appearance 130 Refining the font and colors 145
Changing the layout 132
Adding comments 148
Creating a tailored Attaching comments to files 148
configuration profile 136 Entering packet comments 148
Customizing a profile 136 Viewing and saving comments 149
Crafting buttons 139
Summary 150
Adjusting columns, Questions 151
font, and colors 141
x Table of Contents
7
Using Display and Capture Filters
Filtering network traffic 154 Understanding the
Analyzing traffic 154 expression builder 168
Comparing the filters' files 156 Building an expression 170
8
Outlining the OSI Model
An overview of the OSI model 182 Traveling over the Physical layer 197
Developing the framework 182
Exploring the
Using the framework 183
encapsulation process 198
Discovering the purpose Viewing the data 199
of each layer, the protocols, Identifying the segment 199
and the PDUs 183 Characterizing the packet 200
Evaluating the Application layer 185 Forming the frame 200
Dissecting the Presentation layer 186
Demonstrating frame
Learning about the Session layer 188
formation in Wireshark 201
Appreciating the Transport layer 190
Examining the network bindings 202
Explaining the Network layer 193
Examining the Data Link layer 196 Summary203
Questions203
Table of Contents xi
10
Managing TCP Connections
Dissecting the Permitting SACK 257
three-way handshake 242 Using timestamps 259
Isolating a single stream 243
Understanding TCP
Identifying the handshake packets 248
protocol preferences 260
Learning TCP options 252 Modifying TCP preferences 262
Grasping the EOL option 254
Tearing down a connection 264
Using NOP 254
Defining the MSS 255
Summary266
Scaling the WS 256 Questions266
Further reading 268
xii Table of Contents
11
Analyzing IPv4 and IPv6
Reviewing the network layer 270 Editing protocol preferences 287
Understanding the purpose of IP 271 Reviewing IPv4 preferences 287
Adjusting preferences for IPv6 290
Outlining IPv4 272
Dissecting the IPv4 header 273 Discovering tunneling protocols291
Modifying options for IPv4 282 Summary292
Exploring IPv6 282 Questions293
Navigating the IPv6 header fields 283 Further reading 295
12
Discovering ICMP
Understanding the purpose of Providing information using ICMPv6 312
ICMP298
Evaluating type and code values315
Understanding the ICMP header 299
Reviewing ICMP type and code values 315
Investigating the data payload 302
Defining ICMPv6 type and code values 317
Dissecting ICMP and ICMPv6 305
Configuring firewall rules 318
Reviewing ICMP 305
Acting maliciously 318
Outlining ICMPv6 306
Allowing only necessary types 323
Sending ICMP messages 307
Summary324
Reporting errors on the network 308
Issuing query messages 311
Questions324
Further reading 326
14
Examining DHCP
Recognizing the purpose of Understanding DHCP messages 375
DHCP 360 Comparing DHCP options 376
Configuring the client's IP address 361
Following a DHCP example 377
Using a DHCP relay agent 361
Releasing an IP address 377
Working with IPv6 addresses 363
Broadcasting a discover packet 379
Addressing security issues 365
Delivering an offer 380
Stepping through Requesting an IP address 382
the DORA process 366 Acknowledging the offer 383
Moving through DHCP states 366
Summary384
Obtaining an IP address 367
Leasing an IP address 370 Questions 385
Further reading 387
Dissecting a DHCP header 372
Examining DHCP field values 373
15
Decoding HTTP
Describing HTTP 390 Keeping track of the connection394
Dissecting a web page 390 Evaluating connection types 395
Understanding HTTP versions 393 Maintaining state with cookies 396
Recognizing HTTP methods 394
Comparing request and
response messages 398
xiv Table of Contents
16
Understanding ARP
Understanding the role and Reversing ARP 427
purpose of ARP 418 Evaluating InARP 428
Resolving MAC addresses 419 Issuing a gratuitous ARP 430
Investigating an ARP cache 421 Working on behalf of ARP 430
Replacing ARP with NDP in IPv6 423
Comparing ARP attacks and
Exploring ARP headers defense methods 432
and fields 423 Comparing ARP attacks and tools 432
Identifying a standard ARP Defending against ARP attacks 435
request/reply 423
Summary436
Breaking down the ARP header fields 425
Questions 437
Examining different types Further reading 438
of ARP 427
18
Subsetting, Saving, and Exporting Captures
Discovering ways Recognizing ways to
to subset traffic 466 export components 477
Dissecting by an IP address 467 Selecting specified packets 478
Narrowing down by conversations 470 Exporting various objects 480
Minimizing by port number 471
Breaking down by protocol 472
Identifying why and how
to add comments 482
Subsetting by stream 473
Providing file and packet comments 482
Understanding options Saving and viewing comments 484
to save a file 474
Using Save as 476
Summary 487
Questions 487
19
Discovering I/O and Stream Graphs
Discovering the Statistics menu 492 Comparing TCP stream graphs 506
Viewing general information 493 Using time sequence graphs 506
Assessing protocol effectiveness 494 Determining throughput 512
Graphing capture issues 497 Assessing Round Trip Time 514
Evaluating window scaling 515
Creating I/O graphs 499
Examining errors 500 Summary 517
Graphing duplicate ACKs 501 Questions 517
Modifying the settings 502
Exploring other options 504
20
Using CloudShark for Packet Analysis
Discovering CloudShark 522 Outlining the various
Modifying the preferences 523 filters and graphs 532
Uploading captures 525 Displaying data using filters 533
Working with capture files 526 Viewing data using graphs 534
xvi Table of Contents
Chapter 3, Installing Wireshark, illustrates how Wireshark provides support for different
operating systems. We'll compare the different capture engines, such as WinPCap,
LibPcap, and Npcap, walk through a standard Windows installation, and then review the
resources available at https://www.wireshark.org/.
Chapter 4, Exploring the Wireshark Interface, provides a deeper dive into some of the
common elements of Wireshark to improve your workflow. We'll investigate the welcome
screen and common menu choices, such as File, Edit, and View, so that you can easily
navigate the interface during an analysis.
Chapter 5, Tapping into the Data Stream, starts with a comparison of the different network
architectures and then moves on to the various capture options. You'll discover the
conversations and endpoints you'll see when tapping into the stream, and then learn about
the importance of baselining network traffic.
Chapter 6, Personalizing the Interface, helps you to realize all the ways you can customize
the many aspects of the interface. You'll learn how to personalize the layout and general
appearance, create a tailored configuration profile, adjust the columns, font, and color, and
create buttons.
Chapter 7, Using Display and Capture Filters, helps you to make examining a packet
capture less overwhelming. We'll take a look at how to narrow your scope by filtering
network traffic. We'll compare and contrast display and capture filters, discover the
shortcuts used to build filters, and conclude with a review of the expression builder.
Chapter 8, Outlining the OSI Model, provides an overview of the Open Systems
Interconnection (OSI) model, a seven-layer framework that outlines how the OS prepares
data for transport on the network. We'll review the purpose, protocols, and Protocol Data
Units (PDUs) of each layer, explore the encapsulation process, and demonstrate the frame
formation in Wireshark.
Chapter 9, Decoding TCP and UDP, is a deep dive into two of the key protocols in the
transport layer – the Transmission Control Protocol (TCP) and the User Datagram
Protocol (UDP). We'll review the purpose of the transport layer and then evaluate the
header and field values of both the TCP and the UDP.
Chapter 10, Managing TCP Connections, begins by examining the three-way handshake.
We'll discover the TCP options, get a better understanding of the TCP protocol
preferences, and then conclude with an overview of the TCP teardown process.
Chapter 11, Analyzing IPv4 and IPv6, provides a breakdown of the purpose of the Internet
Protocol (IP). We'll outline IPv4 and the header fields and then explore the streamlined
header of IPv6. We'll summarize with a discussion of the protocol preferences and see
how IPv4 and IPv6 can coexist by using tunneling protocols.
Preface xix
Chapter 12, Discovering ICMP, details the purpose of the Internet Control Message
Protocol (ICMP). We'll dissect ICMP and ICMPv6, compare query and error messages,
and discuss the ICMP type and code values. We'll cover how ICMP can be used in
malicious ways and outline the importance of configuring firewall rules.
Chapter 13, Diving into DNS, outlines the significance of the Domain Name System
(DNS). You'll learn how DNS works when resolving a hostname to an IP address. We'll
compare the different types of records, step through a query and response, review the
DNS header, and calculate the DNS response time using Wireshark.
Chapter 14, Examining DHCP, begins by explaining the need for the Dynamic Host
Configuration Protocol (DHCP). We'll then outline the DORA process – Discover Offer
Request Acknowledge. We'll dissect a DHCP header and review all the field values, flags,
and port numbers, and then finish by stepping through a DHCP example.
Chapter 15, Decoding HTTP, highlights the Hypertext Transfer Protocol (HTTP),
an application layer protocol used when browsing the web. We'll learn the details of
HTTP, explore common methods of transport, and dissect the header and fields. We'll
then compare request and response messages, and then summarize by following an
HTTP stream.
Chapter 16, Understanding ARP, takes a closer look at the Address Resolution Protocol
(ARP), which is a significant protocol in delivering data. We'll outline the role and
purpose of ARP, explore the header and fields, describe the different types of ARP, and
take a brief look at ARP attacks.
Chapter 17, Determining Network Latency Issues, outlines how even a beginner can
diagnose network problems. We'll explore coloring rules and the Intelligent Scrollbar, and
then conclude with an overview of the expert information, which divides the alerts into
categories and guides you through a more targeted evaluation.
Chapter 18, Subsetting, Saving, and Exporting Captures, helps you to explore the many
different ways in which to break down a packet capture into smaller files for analysis. We'll
cover the different options when saving a file, discover ways to export components such as
objects, session keys, and packet bytes, and then outline why and how to add comments.
Chapter 19, Discovering I/O and Stream Graphs, begins by covering the many ways the
statistics menu can help us when analyzing a capture file. We'll create basic I/O graphs to
help visualize network issues and summarize by comparing how the different TCP stream
graphs provide a visual representation of the streams.
xx Preface
Chapter 20, Using CloudShark for Packet Analysis, covers CloudShark, an online
application that is similar to Wireshark. You'll learn how to filter traffic and generate
graphs. We'll then review how you can share captures with colleagues and outline where
you can find sample captures so that you can continue improving your skills.
Conventions used
There are a number of text conventions used throughout this book.
Code in text: Indicates code words in text, database table names, folder names,
filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles.
Here is an example: "To write to a file, use -w, then the filename and path."
Any command-line input or output is written as follows:
Bold: Indicates a new term, an important word, or words that you see onscreen. For
instance, words in menus or dialog boxes appear in bold. Here is an example: "Once
you're in CloudShark, select the Export | Download File drop-down menu."
Get in touch
Feedback from our readers is always welcome.
General feedback: If you have questions about any aspect of this book, email us
at customercare@packtpub.com and mention the book title in the subject of
your message.
Errata: Although we have taken every care to ensure the accuracy of our content,
mistakes do happen. If you have found a mistake in this book, we would be grateful if
you would report this to us. Please visit www.packtpub.com/support/errata
and fill in the form.
Piracy: If you come across any illegal copies of our works in any form on the internet,
we would be grateful if you would provide us with the location address or website name.
Please contact us at copyright@packt.com with a link to the material.
If you are interested in becoming an author: If there is a topic that you have expertise
in and you are interested in either writing or contributing to a book, please visit
authors.packtpub.com.
In this section, we’ll outline the value of traffic analysis, learn about the evolution of
Wireshark, and step through the phases of packet analysis. We’ll then discuss some of
the command-line interface tools, outline how to download and install Wireshark, and
explore the interface along with commonly accessed menu choices.
The following chapters will be covered under this section:
In this chapter, we will address all of this by covering the following topics:
We use packet analysis in many places, including on a LAN, on a host, or in the real world.
Additionally, we use packet analysis when troubleshooting latency issues, testing Internet
of Things (IoT) devices, and as a tool when baselining the network.
Today, packet analysis using Wireshark is a valuable skill. However, analyzing packets has
been around in the networking world for many years. As early as the 1990s, various tools
enabled analysts to carry out packet analysis on the network to troubleshoot errors and to
monitor server behavior. In the next section, we'll examine some of the early tools used to
monitor network activity.
Reviewing packet analysis 5
In the next section, we'll take a look at the various devices that use packet analysis today.
6 Appreciating Traffic Analysis
• A router captures the traffic and examines the IP header to determine where to
send the traffic, as part of the routing process.
• An IDS examines the traffic and alerts the network administrator if there is any
unusual or suspicious behavior.
• A firewall monitors all traffic and will drop any packets that are not in line with
the Access Control List (ACL).
For example, when data passes through a firewall, the device examines the traffic and
determines whether to allow or deny the packets according to the ACL.
Using an ACL
When using a firewall, an ACL governs the type of traffic that is allowed on the network.
For example, an ACL has the following entries:
To decide whether to allow or deny a packet, the firewall must check each header as it
passes through the device. It will determine variables such as IP addresses, Transmission
Control Protocol (TCP) flags, and port numbers that are in use. If the packet does not
meet the ACL entry, the firewall will drop the packet. As shown in the following diagram,
an inbound SYN packet with a destination port of 80 is blocked because it does not match
the rule:
Other documents randomly have
different content
The Project Gutenberg eBook of The Mongols in
Russia
This ebook is for the use of anyone anywhere in the United States
and most other parts of the world at no cost and with almost no
restrictions whatsoever. You may copy it, give it away or re-use it
under the terms of the Project Gutenberg License included with
this ebook or online at www.gutenberg.org. If you are not located
in the United States, you will have to check the laws of the country
where you are located before using this eBook.
Language: English
[Contents]
[Contents]
Jeremiah Curtin in the Ruins of the Roman Forum
[Contents]
THE MONGOLS IN RUSSIA
BY
JEREMIAH CURTIN
AUTHOR OF “THE MONGOLS, A HISTORY,”
“MYTHS AND FOLK-LORE OF IRELAND,”
“HERO-TALES OF IRELAND,” “MYTHS AND
FOLK-TALES OF THE RUSSIANS, WESTERN
SLAVS, AND MAGYARS,” “CREATION MYTHS
OF PRIMITIVE AMERICA,” ETC.
BOSTON
LITTLE, BROWN, AND COMPANY
1908
[Contents]
Copyright, 1908,
By A. M. Curtin.
Colonial Press
Electrotyped and Printed by C. H. Simonds & Co.
Boston, U. S. A.
[Contents]
THIS WORK
AS WAS ITS COMPANION VOLUME
The Mongols, A History
IS DEDICATED TO
Theodore Roosevelt
PRESIDENT OF THE UNITED STATES
[Contents]
NOTE
[Contents]
CONTENTS
CHAPTER I PAGE
CHAPTER II
CHAPTER III
CHAPTER IV
CHAPTER V
CHAPTER VI
CHAPTER VII
CHAPTER VIII
CHAPTER IX
CHAPTER X
CHAPTER XI
CHAPTER XII
CHAPTER XIII
CHAPTER XIV
CHAPTER XV
CHAPTER XVI
CHAPTER XVII
CHAPTER XVIII
CHAPTER XIX
Birth of Ivan III, January 22, 1440.—Consolidation of Russia.—
Decline of Novgorod.—Martha Boretski, the Novgorod patriot, favors
Kazimir.—Defeat of the Boretski party.—Disputes in Moscow.—
Epistles of the metropolitan Philip.—Fall of Novgorod.—Decision of
Ivan of Moscow.—Prince Shuiski.—Attack on Novgorod by Ivan.—
Siege of Deman by Moscow.—Riots in Novgorod.—Success of
Moscow.—Submission of Novgorod 454
CHAPTER XX
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
textbookfull.com