Wireshark for Security Professionals. Parker Jeff T.

and any host except beta)

      • tcp port 80 (captures all TCP traffic across port 80)

       Debugging Capture Filters

      Capture filters operate on a low level of the captured network data. They are compiled to processor opcodes (processor language) in order to ensure high performance. The compiled BPF can be shown by using the -d operator on tcpdump, Dumpcap, or TShark, and in the Capture Options menu in the GUI.

      This is useful when debugging a problem where your filter is not doing exactly what you were expecting. The following is an example output of a BPF filter:

      As previously mentioned, using the -d operator will show the BPF code for the capture filter. And, used in the example above, the -f operator will show the libpcap filter syntax.

      Following is a line-by-line explanation of the BPF:

      • Line 0 loads the offset for the second part of the source address.

      • Line 1 compares the packet at the offset to 2030405 and jumps to line 2 if it matches, or line 4 if it doesn't match.

      • Lines 2 and 3 load the offset for the first part of the source address and compare it to 0001. If this also matches, it can return 65535 to capture this packet.

      • Lines 4 through 7 do the same as lines 0 through 3 but for the destination address.

      • Lines 8 and 9 are instructions to return.

      You can use this method of analyzing the filter step by step to verify where the filter is going wrong.

       Capture Filters for Pentesting

      We suspect you already know this, but we'll add this, just in case: “Pentesting” is short for penetration testing, the art of testing a computer, network, or application to search for vulnerabilities. Any pentesters reading this book are familiar with the concept that you end up getting blamed for every problem that happens on the network even if you aren't connected to it at the time. As such capturing data on a pentest is helpful when you need to prove to upset clients that you genuinely had nothing to do with the switch dying or a business-critical SCADA system exploding. It is also helpful when you need to review your packet captures for general information gathering or post-test analysis and reporting.

      The following snippet would capture all your outgoing traffic to serve as a logbook for your actions on the network. It captures only traffic coming from your network card identified by the MAC address and saves it split up in multiple time-stamped files prefixed by pentest. Notice that Dumpcap was used here instead of the GUI or TShark.

      dumpcap – f "ether src host 00:0c:29:57:b3:ff" – w pentest – b filesize:10000

      You can run this snippet in the background, as running an entire instance of Wireshark would tie up too much of the system resources.

      Saving only the outgoing traffic is not much use for pentest analysis. To capture all traffic going to and from your testing machine combined with broadcast traffic, use the following snippet:

      dumpcap – f "ether host 00:0c:29:57:b3:ff or broadcast" – w pentest – b filesize:10000

      As you can see, only the src directive was dropped, and a broadcast expression was combined with the Ethernet expression using the or statement.

      The following pentesting snippet can also be used to capture traffic to and from a list of IP addresses, such as all the IPs that are in scope for your pentest. This applies to cases where you are using multiple virtual machines and thus MAC addresses, but you want to be able to log all relevant traffic.

      dumpcap – f "ip host 192.168.0.1 or ip host 192.168.0.5"

      The list of hosts could get a little large to type by hand, so it is more practical to store your in-scope targets in a hosts.txt file and use it instead. To generate the filter itself, use the following one-liner and strip the last or:

      cat hosts.txt | xargs – I% echo – n "ip host % or "

      Display Filters

      To get started with display filters, we begin with a brief explanation of the syntax and available operators, followed by a walkthrough of a typical use that should get you up to speed in no time.

The display filter syntax is based on expressions returning true or false by using operators for comparison. This can be combined with Boolean logic operators to combine several expressions so that you can really drill down your results. See Table 1-1 for the most common comparison operators.

Table 1-1: Comparison Operators

      Source: http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html

      If you have used any modern programming language, the syntax should look familiar. To make a useful expression, you have to match these operators against variables in the packet. This is possible in Wireshark by accessing variables grouped by protocol. For example, ip.addr would contain the destination and the source address. The following statement filters all the traffic coming from or going to the supplied IP address: ip.addr == 1.2.3.4. This works by matching against both the destination and the source address header in the IP packet so that it will return true for packets in both directions.

      NOTE

      Keep in mind that the expression tests both values of the specified variable if it occurs more than once in the packet. For example, eth.addr will match both the source and destination. This can lead to unexpected behavior if the expressions are grouped incorrectly. This is especially true in expressions featuring negation, such as eth.addr != 00:01:02:03:04:05. This will always return true.

      In the previous example on comparison operators, an IP address was compared to the variable ip.addr to only show traffic from and to that IP. If you were to try to compare the same variable to google.com, Wireshark would present an error message because the variable is not an IP address. The variables available to use in expressions are typed. This means that the language expects an object of a certain type to be compared only to a variable of the same type. To see the available variables and their types, you can use the Wireshark Display Filter Reference page at http://www.wireshark.org/docs/dfref/. In practice, you can also see the values Wireshark expects for each element in the packet by inspecting the packet using the Packet Details pane. The variable names can be found on the bottom left of the screen in the status bar or looked up in the reference. The status bar lists the filter field for the selected line in the Packet Details pane.

For an example of this, see Figure 1-4. A packet is captured, and 1 byte is highlighted in the Packet Details pane. The 1-byte portion denotes the IP version. See the lower left of the application, on the status bar: “Version (ip.version), 1 byte.”

Figure 1-4: Field information in the status bar

A good way to filter the available packets is to decide on an expression by inspecting a packet that interests you. It is easier to see the differentiating markers between packets you do want to see by comparing fields in the Packet Details pane. As shown in Figure 1-5, each field in the ARP packet is listed with a readable value (hex in the Packet Details pane) followed by the raw value (on the right side of the Packet Details pane). Both of these values can generally be used in an expression, as Wireshark transforms the readable format to the corresponding raw format for your convenience. For example, if you want to see only ARP requests in the Packet List pane, the filter would be arp.opcode == 1. In this case, typing request would not