Description
Book SynopsisWith the advent of emerging and complex technologies, traffic capture and analysis play an integral part in the overall IT operation. This book outlines the rich set of advanced features and capabilities of the Wireshark tool, considered by many to be the de-facto Swiss army knife for IT operational activities involving traffic analysis. This open-source tool is available as CLI or GUI. It is designed to capture using different modes, and to leverage the community developed and integrated features, such as filter-based analysis or traffic flow graph view.You'll start by reviewing the basics of Wireshark, and then examine the details of capturing and analyzing secured application traffic such as SecureDNS, HTTPS, and IPSec. You'll then look closely at the control plane and data plane capture, and study the analysis of wireless technology traffic such as 802.11, which is the common access technology currently used, along with Bluetooth. You'll also learn waysto identify network attacks,
Table of ContentsChapter 1: Wireshark Primer
· Introduction to Wireshark Architecture
· Wireshark Package installation and Usage
· Wireshark Cloud Services
· Version and feature parity
· Basic Analysis and filtering
· Data stream and Graphs
· Summary
Chapter 2: Packet Capture and Analysis
§ Native Tool based Traffic Capture
§ Wireshark tool based Traffic Capture
§ Wireless Capture Modes and Configurations
· High volume packet analysis (size based, capture filters)
· Wireshark command line tool
· Mobile devices Traffic Capture
Chapter 3: Capturing Secured Application for Analysis
· Introduction to Secured Applications
· Secure DNS
· HTTPS
· mTLS
· IPsec, ISAKMP, Kerberos
· SNMPv3
· WEP, and WPA/WPA2/WPA3
Chapter4: Wireless Packet Capture and Analysis
· Basics of Wireless Technology
· Wireless packet types (data, control, auth)
· Wireless operational aspects and effect on wireshark capture
· Effect of Wireshark modes (monitor, promiscuous) on wireless capture
· Setting up Wireshark 802.11 captures for various OS types
· Decoding beacons/WEP/WPA/WPA2
· Wireless packet analysis
Chapter 5: Multimedia Capture and Analysis
· Introduction to Multimedia Applications
· Export Objects (file, images applications) from data stream
· video content extraction and replay (RTP / RTSP)
· mpeg live streams capture and replay
· VoIP call analysis and replay
Chapter 6: Cloud and Cloud-Native Traffic Capture
· Introduction and Cloud and Cloud Native Applications
· Native and Wireshark Captures in AWS
· Native and Wireshark Captures in GCP
· Native and Wireshark Captures in Azure
· LXC and Namespace based capture
· Kubernetes POD capture
Chapter 7: Bluetooth Protocol Capture and Analysis· Introduction to Bluetooth and Usecase
· HCIDump captures
· Bluetooth protocol analysis
Chapter 8: Wireshark Analysis and Network Forensic
· Networking protocol operation analysis
· Analyzing network throughput issues, performance degradations
· Network security attack identification , post mortems, prevention
· Discovering malwares, covert communications
· Packet replays
Chapter 9: Writing your own dissector
· Wireshark Dissectors
· Use Case Example
· Dissector Example
