wireshark network protocol analyzer

Sensor Standardization & Harmonization Working Group

1

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Wireshark Network Protocol Analyzer

Jim GilsinnManufacturing Engineering Laboratory (MEL)

National Institute of Standards & Technology (NIST)

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 2

Overview

• Wireshark: What Is It?• A Brief History• What Can It Do?• How Do I Use It?• Demo

– Starting Screen– Capture Screen– Capture File Statistics– Packet Filtering

• Summary• Where Can I Get It?

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 3

Wireshark: What Is It?

• De-facto network packet analyzer• Open-source

– GNU General Public License– Over 680 Contributors

• Multi-platform– Pre-compiled installers for PC/Mac– Source code & instructions for Unix & Linux

• Extensible– Add-ons and extensions are relatively easy to build

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 4

A Brief History

• Started out in 1998 as Ethereal 0.2.0• Became Wireshark in 2006

– Original developer changed companies– Name remained property of previous company– Started as Wireshark 0.99

• Currently 3 versions available– Version 1.0.13 – Old stable release– Version 1.2.8 – Stable release– Version 1.3.5 – Development release

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 5

What Can It Do?

• Capture live network traffic– Variety of networks (Ethernet, WiFi, Bluetooth, USB, etc.)

• Import capture files from multiple packages– 35 different file network capture file formats

• Display packets in great detail– Over 1000 different protocol decoders have been written

• Identify bad packets– Wireshark knows what the packets should look like

• Search and filter packets– Over 75k different filter variables

• Track “conversations”

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 6

How Do I Use It?

• Protocol & data analysis– Analyze client-server interaction, errors, network data

verification

• Latency– Client-server request-response timing

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 7

How Do I Use It?

• Non-web-based applications– Jitter on repeating network packets– Hardware-assisted packet analysis

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 8

How Do I Use It?

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 9

Starting Screen

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 10

Capture Screen

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 11

Capture Screen: Filtered Packets

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 12

Capture Screen: Packet Details

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 13

Capture Screen: Packet Hex/ASCII

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 14

Capture File Statistics

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 15

Statistics: Summary

May 18, 2010

• Basic information about the file

• File format• Number of packets• Capture duration• Average

packets/second

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 16

Statistics: Protocol Hierarchy

May 18, 2010

• Displays protocol layering• Shows basic statistics for each protocol layer

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 17

Statistics: Conversations

May 18, 2010

• Identifies and tracks individual streams of traffic• Can track multiple protocols

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 18

Statistics: IO Graph

• Graphical representation of packet timing• Helps identify causes/effects for packets

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 19

Packet Filtering

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 20

Building Packet Filters

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 21

Summary

• Wireshark is the de-factor standard– Very versatile– Extensible

• Wireshark provides insight into what’s happening on the network– Capture and view network traffic– Investigate network issues– Monitor application interactions

• The only way to understand your network is to understand the packets

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 22

Where Can I Get It?

• Wireshark Website– http://www.wireshark.org

• Wireshark Download– http://www.wireshark.org/download.html

• Wireshark Documentation– http://www.wireshark.org/docs/

• Wireshark Wiki– http://wiki.wireshark.org/

May 18, 2010

Manufacturing Engineering Laboratory (MEL)National Institute of Standards & Technology (NIST)

U.S. Department of Commerce, Technology Administration

Sensor Standardization & Harmonization Working Group 23

Questions?

• Jim Gilsinn– Intelligent Systems Division

Manufacturing Engineering LaboratoryNational Institute of Standards & Technology100 Bureau Drive, Stop 8230Gaithersburg, MD 20899-8230

– 301-975-3865– james.gilsinn@nist.gov– http://www.nist.gov/mel/isd

May 18, 2010