{"id":239,"date":"2022-01-14T14:09:45","date_gmt":"2022-01-14T14:09:45","guid":{"rendered":"http:\/\/miriamposner.com\/classes\/is270w22\/?page_id=239"},"modified":"2022-01-14T14:19:05","modified_gmt":"2022-01-14T14:19:05","slug":"snoop-on-network-activity-with-wireshark","status":"publish","type":"page","link":"https:\/\/miriamposner.com\/classes\/is270w22\/resources\/snoop-on-network-activity-with-wireshark\/","title":{"rendered":"Snoop on network activity with Wireshark"},"content":{"rendered":"\n

Wireshark is a “packet sniffer,” meaning it’s a piece of software that people use to observe and analyze network activity. When Wireshark is \u201ccapturing,\u201d it makes a copy of every packet traveling on your local network and displays it for your examination. It can do pretty sophisticated things — it’s actually an industry standard in the field of network analysis — but we’ll use it today to peek at network activity, in order to get a better sense of how the internet works.<\/p>\n\n\n\n

1. Download the capture file<\/h3>\n\n\n\n

Go to https:\/\/bruinlearn.ucla.edu\/files\/7715424\/download?download_frd=1<\/a> to download our PCAP file. PCAP stands for \u201cpacket capture\u201d and is the standard file format for viewing network activity. Save the file someplace where you’ll be able to find it easily. You don’t have to open it quite yet.<\/p>\n\n\n\n

The picture below is an excerpt from a newspaper article<\/a> about Republican attempts to prove that voter fraud took place over networks. You can see that PCAPs are the standard way network experts analyze network activity.<\/em><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

2. Open Wireshark<\/h3>\n\n\n\n

Double-click on Wireshark to open it. You’re greeted with a welcome screen.<\/p>\n\n\n\n

(Note: If Wireshark starts capturing as soon as you open it — you can tell because the main window will immediately fill with lines of text — press the stop sign next to the shark fin at the top left of the Wireshark window. Then continue.)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

3. Open the sample PCAP file.<\/h3>\n\n\n\n

Click on File<\/strong>, then Open<\/strong>, and then find the file you downloaded in step 1.<\/p>\n\n\n\n

(If you had to press the stop sign in the previous step, Wireshark may ask you if you want to “save the current capture.” You don’t. Press “continue without saving.”)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

4. What are you looking at?<\/h3>\n\n\n\n

Wireshark’s interface consists of three main panes. The first, the main window, contains a list of all the network activity Wireshark observed during the capture period. (The colors of the highlighting on your version might be different from mine.) What are the color codes?<\/a> The second, the middle window, gives you information about the highlighted line. The third, bottom window contains the actual message, in bytes. Usually it’s hard to read because it’s in hexadecimal and then ASCII code. You can minimize that bottom window, if you want.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5. Anatomy of a packet<\/h3>\n\n\n\n

The number column (1) <\/strong>tells you which line you’re on in your list of packets. That also serves as a good way to identify which packet you’re talking about. The Time column (2)<\/strong> tells you how many seconds have elapsed since the capture started. Source (3)<\/strong> is the network address (IP address) from which the packet was generated. Destination (4)<\/strong> is the IP address to which the packet was sent. Protocol (5)<\/strong>, of course, tells you which protocol was contained in the packet. Length (6)<\/strong> tells you how many characters the packet contains. And Info (7)<\/strong> gives you more information about the request.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

6. Get some information about the PCAP<\/h3>\n\n\n\n

There are so many lines here, it’s hard to tell what’s going on. Let’s try to get an overview of the entire capture. From the Statistics <\/strong>menu at the top of your screen, choose Capture File Properties<\/strong>. In the ensuing window, you can get some useful information about the PCAP: for example, it captures 12 seconds of activity and 1,961 packets. (You can also tell what kind of computer I have!)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

7. Snoop on my web activity<\/h3>\n\n\n\n

In the 12 seconds that elapsed, I visited some websites. Remember, every time I typed a URL in my browser, my browser sent out a DNS request, in order to translate that URL into a website address. So let’s just look at DNS requests. In the Display filter<\/strong> window above the main pane, type dns<\/strong>. The search box will turn green when you’ve entered a kind of protocol that Wireshark understands; you can’t just enter anything! Press enter.<\/p>\n\n\n\n

Now you’ll see only DNS requests.<\/p>\n\n\n\n

Question 1: Can you tell what my favorite hobby is? <\/strong>(Hint: look carefully at the Info column.)<\/p>\n\n\n\n

Question 2: I only entered two URLs during the capture period.<\/strong> Why do you think there are so many DNS requests during this period?<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

8. Make the addresses a little easier to read.<\/h3>\n\n\n\n

Delete the dns filter from the Display filter <\/strong>window by clicking on the tiny x<\/strong> at the far right of the search bar. You should now see all the packets again.It might make your work a little easier if you convert the IP addresses into human-readable names. From the View <\/strong>menu, choose Name resolution<\/strong> and check Resolve network addresses.<\/strong> Wireshark won’t be able to resolve every address (why not<\/a>?) but it will make some IP addresses easier to read.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

9. See the protocol breakdown<\/h3>\n\n\n\n

Let’s look at the percentage breakdown of the various protocols. From the Statistics<\/strong> menu, select Protocol Hierarchy<\/strong>. This tells you what percentage of packets contain each kind of protocol. Why do the numbers add up to more than 100%? That’s because each packet actually contains multiple protocols, even though Wireshark has divided them up in the main window so that you can focus on each protocol, one at a time.<\/p>\n\n\n\n

Question 3: Most packets contain either TCP or UDP protocols. Why would that be?<\/strong><\/p>\n\n\n\n

Question 4: What’s the Address Resolution Protocol? What’s it doing there?<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

10. Investigate a packet<\/h3>\n\n\n\n

Scroll down to line 1750. It looks a little different from the others.<\/p>\n\n\n\n

Question 5: Can you tell what’s going on in here? <\/strong>(Feel free to Google terms.)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

11. Background noise<\/h3>\n\n\n\n

If your computer is connected to the internet, it’s always chattering away, even if you’re not doing anything.<\/p>\n\n\n\n

Question 6: Can you tell what service I use to sync my files to the cloud? <\/strong>(Hint: Start from the first line and scroll down slowly. You should be able to figure this out by the time you get to line 300.)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

12. Capture your own activity<\/h3>\n\n\n\n

WARNING: this file will get big FAST, especially since you’re running Zoom, so start and stop the capture within a few seconds!<\/p>\n\n\n\n

OK, want to see what someone could see if they sniffed packets on your network? It’s easy to capture packets!<\/p>\n\n\n\n

Click on the blue sharkfin at the top left of the Wireshark interface.<\/p>\n\n\n\n

You may be presented with a screen like that pictured in step 2, in which you are asked to choose between various kinds of network connections, like Wi-Fi, ethernet, and a bunch of uninterpretable names. You probably want wifi — pick the connection that has the most activity, as shown in its corresponding line graph.<\/em><\/p>\n\n\n\n

Then VERY QUICKLY click on the stop sign right next door to the shark fin. By default Wireshark’s captures are “promiscuous,” meaning they capture not only your own activity but the activity of every device on the same network as you.<\/p>\n\n\n\n

Question 7: What do you see? What could someone tell about you and your household from a few seconds of your network activity?<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

Wireshark is a “packet sniffer,” meaning it’s a piece of software that people use to observe and analyze network activity. When Wireshark is \u201ccapturing,\u201d it makes a copy of every… Continue reading Snoop on network activity with Wireshark<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":75,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_eb_attr":"","footnotes":""},"class_list":["post-239","page","type-page","status-publish","hentry","entry"],"_links":{"self":[{"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/pages\/239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/comments?post=239"}],"version-history":[{"count":0,"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/pages\/239\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/pages\/75"}],"wp:attachment":[{"href":"https:\/\/miriamposner.com\/classes\/is270w22\/wp-json\/wp\/v2\/media?parent=239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}