Wireshark - Protocol Analyser

Networks

Computer networks have become an important part of our daily life. We rely and depend on such networks to accomplish many tasks on a daily basis we often do not realize their existence. The phone calls, paying bills, transport, operating of rail and road networks everything depend on the computer networks that provide and carry out many tasks electronically.

Therefore networks attract significant attention when it comes to security and the number of attacks being carried out on them are increasing.

Vulnerabilities

Variety of devices, protocols, transmission, data and applications that make up the
network contributes to the many vulnerabilities the network will possess.

Attacks

Denial of service, spoofing, man-in-the-middle and replay are some of the types of attacks that can be performed on a network.

Wireshark

Wireshark is worlds foremost network protocol analyser according to their about wireshark Webpage.

This tool can be used on many different platforms to analyse a variety of protocols that a device is receiving and transmitting.

The windows installation is utilizing another industry standard software called WinPcap, Windows packet capture library. This is used to gain link layer network access on Windows environments.

Download Wireshark

Wireshark can be downloaded from the website download page or one of the mirror sites listed on their website. Once the download is complete run the .exe to install the software. It will prompt to install WinPcap and use the default setting of start WinPcap on start up to enable easy use of the application.

Launch Wireshark

Launch Wireshark and click Capture and Interfaces. Select the network interface adapter of the computer and click start button.

View captured packets

Depending on the network traffic, it will capture and display the packets captured.
If nothing appears untick "capture packets in promiscuous mode".

View login information

Direct the web browser to url www.medialightbox.com/login

Enter user id Gerald and password happy and press enter. The login attempt will fail as there is no valid user with this credentials and an error message will be displayed as below.

Find data in packets

Return to Wireshark window, click edit then find packet. Click string, type Gerald in the filter field and click find. Records will be shown which contains the searched string.

In steps 7 and 8 the wireshark captures the data being transmitted to and from the computer as data packets. Their contents are then displayed along with other information such as source, destination IP address, protocol and status codes.

When the data are transmitted as encrypted content such using ssl protocol wireshark will not be able to display the data content as plain text.