Table Of ContentN e t w ork Ana lysis
U sing Wire sha rk
Cook book
Over 80 recipes to analyze and troubleshoot network
problems using Wireshark
Yoram Orzach
BIRMINGHAM - MUMBAI
Network Analysis Using Wireshark
Cookbook
Copyright © 2013 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system,
or transmitted in any form or by any means, without the prior written permission of the
publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the
information presented. However, the information contained in this book is sold without
warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers
and distributors will be held liable for any damages caused or alleged to be caused directly
or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: December 2013
Production Reference: 1171213
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-84951-764-5
www.packtpub.com
Cover Image by iStockPhoto
Cre dit s
Author Technical Editors
Yoram Orzach Vrinda Nitesh Bhosale
Amit Ramadas
Reviewers Pratik More
Charles L. Brooks
Anita Nayak
Praveen Darshanam
Ritwik Ghoshal Project Coordinator
Gilbert Ramirez Anugya Khurana
Acquisition Editors Proofreader
Nikhil Chinnari Bridget Braund
Akram Hussain
Indexers
Antony Lowe
Monica Ajmera Mehta
Rekha Nair
Lead Technical Editor
Ritika Dewani Priya Subramani
Copy Editors Graphics
Roshni Banerjee Disha Haria
Janbal Dharmaraj Abhinash Sahu
Brandt D'Mello
Production Coordinator
Kirti Pai
Nitesh Thakur
Shambhavi Pai
Alida Paiva
Cover Work
Lavina Pereira
Nitesh Thakur
Sayanee Mukherjee
Karuna Narayanan
About t he Aut hor
Yoram Orzach gained his Bachelor's degree in Science from the Technion in Haifa, Israel,
and worked in Bezeq as a systems engineer in the ields of transmission and access networks
from 1991 to 1995. In 1995, he joined Netplus from the Leadcom group as technical manager,
and since 1999 he has worked as the CTO of NDI Communications (www.ndi-com.com),
involved in the design, implementation, and troubleshooting of data communication networks
worldwide. Yoram's experience is both with corporate networks, service providers, and Internet
service provider's networks, and among his customers are companies such as Comverse,
Motorola, Intel, Ceragon networks, Marvel, HP, and others. Yoram's experience is in design,
implementation, and troubleshooting, along with training for R&D, engineering, and IT groups.
Ack now le dgm e nt s
First and foremost, I would like to thank my family: my parents Israel and Selma; my father,
the smartest man on earth, who survived the holocaust weighing 35 kilos alone in the world,
and 40 years later became a leading expert in telecommunications; my mother, who taught
me so many things; my amazing wife Ena, who has been tolerating me being at work over the
last 20 years and more; my children Nadav, Dana, and Idan, whose achievements made my
work look so simple. Thanks to my sister Hana, her husband Ofer, and their children.
I would also like to thank many colleagues. First, Reuven Matzliach, who started the Comverse
IP college with me in the later 90s, transferring Comverse from TDM to IP networks, and
helped me through some dificult times. Along with him, I would like to thank Omer Fuchs and
Moshe Sakal for their assistance in this great project. Thanks to many colleagues and friends,
who this paper is too short to mention.
Thanks to Lior Tzuberi, for many tips and case studies. Hanan Man, for a very interesting
network. Yoel Saban and Rami Kletshevsky for very interesting network designs; your design
groups are one of the best I've ever seen. Zvi Shacham, for the data-communication teaching
experience I've gained from him. Asi Alajem for a very interesting network and Oren Gerstner for
very interesting wireless cases. Chen Heffer, the best security expert I've ever known. Yoni Zini,
for helping me with the system part. Ibrahim Jubram, for very interesting cellular cases. Ofer
Sela, for very interesting projects. Amir Lavi and Eran Niditz, for very interesting cases. Dimitrios
Liappis, for interesting cellular cases. Avner Mimon, for great tips and so many others.
Thanks to many training professionals that I've learned so much from. Thirty years ago I
thought giving courses is fun; you taught me it's a profession. Harriet Rubin, Merav Sagi,
Rvital Keinan, Guy Einav, Raanan Dagan, and many others.
Special thanks to Yoav Nokrean and his son Eran, who assisted me with many ideas,
giving me assistance in all possible ways.
I would also like to thank the many colleagues who worked with me over the years; to
customers at home, in Europe, North America, Eastern Asia, and other exotic places.
Troubleshooting a network is always the same, the only question is, is it snowing outside
or is there an exotic coast nearby with tequila?
Special thanks to the many designers that designed bad networks, to developers that
wrote strange implementations for TCP/IP, to IT guys who connected the wrong cables, to
engineering departments who thought that you just connect the cables to the boxes and it
works. That's the best way to learn networking.
To many thousands of students, thanks to all of them for all the hard questions and the
interesting cases that you brought with you; I've learned new things in every course. There
is nothing that is more fun than connecting to networks and ixing problems in real time.
My admiration to the networking and security pioneers—Vint Cerf, Bob Kahn, Radia Perlman,
Adi Shamir, Ronald Rivest, Van Jacobson, Steven McCanne, and so many others. Without you,
we wouldn't have all this.
And lastly to Packt Publishing, for coming up with the idea to write this book and very patiently
accompanying me through the process.
About t he Revie w e rs
Charles L. Brooks is the founder and principal consultant at Security Technical Education,
where he offers services in technical writing, reviewing, instructional design, and education.
Charles also facilitates online courses at Boston University in data communications and
networking, and teaches courses in network security, secure software development, securing
virtualized and cloud infrastructures at Brandeis University, Rabb School of Graduate
Professional Studies, in the MS in Information Security program. Prior to founding Security
Technical Education (www.securityteched.com), Charles worked at EMC and at RSA as a
senior technical education consultant, developing courseware for storage security, Big Data,
network security analysis, and network forensics. Prior to EMC, Charles worked for many years
as a software engineer, team leader, and software architect; and most recently as a systems
architect for a managed VPN service offered by GTE Internetworking and Genuity.
Charles earned a BS and MA degree in English from Clark University, a MSCIS degree
from Boston University, and holds several industry certiications including the CISSP, CEH,
and CHFI.
I want to thank Helyn Pultz for her encouragement, support, and timely
counsel for all these many years.
Praveen Darshanam has over seven years of experience in Information Security with
companies such as McAfee, Cisco Systems, and iPolicy Networks. His core expertise and
passions are vulnerability research, signature development, Snort, application security,
and malware analysis. He pursued B.Tech in Electrical Engineering (EE) and ME/M.Tech in
Control and Instrumentation; EE from one of the premier institutes of India. He holds industry
certiications such as CHFI, CEH, and ECSA.
Ritwik Ghoshal is a Senior Security Analyst at Oracle Corporation, responsible for Oracle
software and hardware security assurance. His primary work areas are network security,
operating systems, and virtualization. Before coming to Oracle in 2010, when the company
acquired Sun Microsystems, he had been working at Sun since 2008 as a part of the Sun
security engineering team and the Solaris team. At Oracle, Ritwik continues to be responsible
for all Sun systems products and Oracle Linux and Virtualization products.
Ritwik earned a Bachelor's degree in Computer Science and Engineering in 2008 from
Heritage Institute of Technology, Kolkata, India.
I'm heavily indebted to my parents and Sara E Taverner for their continuous
help and support.
Gilbert Ramirez
is a long-time contributor to Wireshark, starting when it was irst released.
He has added protocol dissectors, core routines such as the display ilter engine, as well as
the initial port to Windows. He works at Cisco Systems, where he handles software build
systems as well as other software tools.
Gilbert has authored books on Wireshark, including Wireshark & Ethereal Network Protocol
Analyzer Toolkit, Ethereal Packet Snifing, and Nessus, Snort, & Ethereal Power Tools, all
published by Syngress Publishing Inc.
w w w.Pa ck t Pub.c om
Support iles, eBooks, discount offers and more
You might want to visit www.PacktPub.com for support iles and downloads related to
your book.
Did you know that Packt offers eBook versions of every book published, with PDF and ePub
iles available? You can upgrade to the eBook version at www.PacktPub.com and as a print
book customer, you are entitled to a discount on the eBook copy. Get in touch with us at
sseerrvviiccee@@ppaacckkttppuubb..ccoomm for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign up
for a range of free newsletters and receive exclusive discounts and offers on Packt books
and eBooks.
http://PacktLib.PacktPub.com
Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book
library. Here, you can access, read and search across Packt's entire library of books.
Why Subscribe?
Fully searchable across every book published by Packt
f
Copy and paste, print and bookmark content
f
On demand and accessible via web browser
f
Free Access for Packt account holders
If you have an account with Packt atwww.PacktPub.com, you can use this to access PacktLib
today and view nine entirely free books. Simply use your login credentials for immediate access.
