How I use Wireshark

https://jvns.ca/blog/2018/06/19/what-i-use-wireshark-for/

by ingve • 8 years ago

552 94 8 years ago

teekert• 8 years ago

Wireshark is worth a couple of hours of play. It was quite a revelation to use it on a non https connection and watch myself transmit my password letter for letter in clear text :) Yes one can imagine how that is, but still, doing it is different.

FabHK• 8 years ago

Or, similarly, I set up an HTTPS proxy on my Mac, and set Wireshark to listen. Then, had someone else log in to a different account (say, the guest account) on the machine, and asked them to log into gmail, say, as usually via HTTPS (with a fake user/pass). A warning does pop up about "insecure connection", but most people just dismiss it and go ahead and log in - and wireshark intercepts username and password.

Classic MiTM, well known, but still freaky to observe how easy it is to set up.

endless12342• 8 years ago

This wouldn't really be possible with a modern browser, luckily, since they don't let users bypass the warning for sites with HSTS.

heavenlyblue• 8 years ago

What's the purpose of this Rude Goldberg's machine if you could do keylogging instead?

kop3165• 8 years ago

Is there a reason that it the website is recommending you install a third party repository in Debian for Wireshark? It is a native package:

https://packages.debian.org/search?searchon=names&keywords=w...

EDIT: It appears that the website has changed, but still comments about installing from the PPA for newer packages. PPAs tend to be for Ubuntu only, and is not meant for other Debian-based distros.

rhodysurf• 8 years ago

Maybe to get the latest up to date version? I know Debian can lag behind having the latest packages

kop3165• 8 years ago

I can understand that logic, however it looks like it isn't too far behind (2.2.x versus 2.6.x). The PPA points to 2.4.x, (https://launchpad.net/~wireshark-dev/+archive/ubuntu/stable) so even the PPA doesn't have the latest. The official website recommends installing it from the official Debian repository(https://www.wireshark.org/download.html).

My greater concern with recommending that is PPA's may not be by the official folks, and PPA's tend to be for Ubuntu rather than Debian, resulting in a "FrankenDebian" (https://wiki.debian.org/DontBreakDebian), and while that PPA seems to be run by the official devs, PPAs can be set up by anyone, which runs into the whole concern of blindly trusting other's code on your system.

EDIT: Here is what the official Debian website says on it: https://wiki.debian.org/DebianSoftware#Footnotes (Footnote 1).

lucb1e2• 8 years ago

If you want up to date software, you should just run Debian testing (or some other distribution/OS). In Debian, testing lags a few days behind unstable to make sure that things aren't breaking and then pushes the update.

mobilemidget• 8 years ago

I use this to run Wireshark on local desktop with live traffic from remote server

e.g. excludes port 22/53

ssh root@host tcpdump -U -s0 'not port 22 and not port 53' -w - | wireshark -k -I -

chatmasta• 8 years ago

Yeah, remote debugging is possibly the best part of wireshark. If you can generate a pcap file and stream it to your machine, you can view it in wireshark.

Kurtz79• 8 years ago

The first time I used this command to monitor traffic remotely on a headless device it felt like magic. Incredibly useful.

You can achieve the same under Windows using putty/plink:

plink.exe -ssh -pw password root@host "tcpdump -ni eth0 -s 0 -w - not port 22" | "C:\Program Files\Wireshark\Wireshark.exe" -k -i -

Of course you need to have tcpdump as a command line executable in the host.

d21d3q2• 8 years ago

Worth to mention that you can dump traffic from router to your machine and debug network in issues between headless/sshless devices.

snug• 8 years ago

Curious, why skip DNS traffic when your capturing all other traffic?

mtve• 8 years ago

seems nobody mentioned rpcapd in this thread - https://github.com/rpcapd-linux/rpcapd-linux could be used to see interfaces on remote linux boxes from windows desktop

dandigangi• 8 years ago

My greatest use thus far with Wireshark was proving that some HTTP requests one of your applications were making actually left the machine and went through our network.

Our Node Proxy was not cooperating and it helped us track down the issues. Nice tool to have in your belt.

Thanks for sharing.

paulie_a• 8 years ago

Wireshark is great, I used it a while back to diagnose why a rogue DHCP server was routing DNS through Germany.

bitcharmer• 8 years ago

Thought someone might find it useful... There is a command line equivalent called tshark. It's great for simple packet processing.

I used it a lot to generate csv files with relevant packet data.

kaiken1987• 8 years ago

Wireshark is fantastic. It also great for listening in on USB connections. The only issue I have with it is I have to use a secondary program to capture the loopback. But rawcap is small lightweight and easy is its not a huge issue

woodrowbarlow• 8 years ago

if i recall correctly, this is a windows-only limitation. i've had no problems capturing loopback on linux. on windows, you can install npcap rather than winpcap to allow capturing on the loopback with wireshark.

taneq2• 8 years ago

I've used it for a few things:

* To analyze the bluetooth protocol for a smartwatch so I could reverse-engineer a phone app to talk to it

* To intercept a temperature logger's TCP comms and figure out how it talked to the vendor's (crap) server software so I could write a better server for it

* To track down a weird problem where ffmpeg won't stream from my home CCTV system (it turns out it sends a duplicate PLAY command, still haven't figured out why yet...)

* To snoop for IP addresses on my local network in order to find lost devices (eg. when someone else set a device to a static IP address which has since been lost).

It's basically a fantastic Swiss Army knife for any question that starts with "what" and ends with "on the network".

retSava• 8 years ago

Would be interesting reads! Do you have any material out there?

taneq2• 8 years ago

Not at the moment but maybe I should start blogging again... :)

_pmf_4• 8 years ago

Also: USB with USBPCap.

My personal pain point is lack of localhost tracing under Windows.

mapl• 8 years ago

Try npcap https://nmap.org/npcap/

Loopback Packet Capture: Npcap is able to sniff loopback packets (transmissions between services on the same machine) by using the Windows Filtering Platform (WFP). After installation, Npcap will create an adapter named Npcap Loopback Adapter for you. If you are a Wireshark user, choose this adapter to capture, you will see all loopback traffic the same way as other non-loopback adapters

EvanAnderson• 8 years ago

Rawcap can do this. It's increasingly showing its age, but I still use it fairly frequently. It generates PCAP files, it's 23KB, and its only dependency is .NET Framework 2.0 (which, admittedly, is becoming more of a problem than a blessing): http://www.netresec.com/?page=RawCap

dharmab• 8 years ago

We recently used it to troubleshoot a problem where 2-3% of TLS connections on a certain VIP were failing. Turns out a switch inside our cloud provider was zeroing out two bits. (TCP CRCs only protect against corruption on the wire, not corruption that happens _inside_ a device!)

That was a fun support ticket.

spydum• 8 years ago

I can one up that. I had corrupt HTTP payloads with what looked like boot loader data being inserted ! I tracked it back to VMWare host with a physical NIC driver that was reading past the buffer, and picking up the bootloader from memory. Inside the guest, wire shark was happy, but upstream at the LB it was receiving the nasty payload.

drewpc• 8 years ago

Same here. I have developed a few dissectors for Wireshark and monitoring tools on top of libpcap and find it immensely useful. I did a writeup of "Troubleshooting TCP Throughput" that involves Wireshark here: http://www.thedrews.net/troubleshoot_tcp_throughput.pdf

rvense• 8 years ago

I was able to quickly reverse engineer a slightly non-standard use of the fastboot protocol to update the firmware on a Linux-based device. Very cool piece of software.

agumonkey• 8 years ago

eavesdropping, open source best friend. :cough:

singularity2001• 8 years ago

used it after I had ssh connections from/to china.

checked to see if system cleanup and hardened firewall kicked them out. After some days with zero traffic (minus broadcast etc) declared red alert over.

CloudNetworking• 8 years ago

Wireshark is my favourite "I told you so" tool. You can't imagine how useful it is for network troubleshooting.

Heck, It's been many times that I've told a customer "you've got this device running this OS in your network doing DPI/ALG/etc and it's probably sitting points at the network diagram exactly here, which you conveniently forgot to add to the diagram" just by looking at a network trace with Wireshark.

krylon2• 8 years ago

You can't imagine how useful it is for network troubleshooting.

I think anyone who has ever had to troubleshoot networking issues can attest to that. I certainly can. ;-)

kasey_junk• 8 years ago

Worth adding that Wireshark has a plugin system for adding protocols.

The fix/fast protocol plugin is something I'd have been in a lot of trouble without in my past.

berti2• 8 years ago

And you can write dissectors in Lua. Super handy for quick/dirty jobs.

toomanybeersies• 8 years ago

I love Wireshark. It's a very useful tool for anything network related. Sometimes I like to boot it up and just look at arp requests being bounced around the network, it's hard to resist the temptation to boot up Metasploit and engage in some script kiddy fun while I'm doing it.

The one problem I have is that usually when I discover I need to use Wireshark, I'm not able to download it as I don't have an internet connection.

TeMPOraL• 8 years ago

The one problem I have is that usually when I discover I need to use Wireshark, I'm not able to download it as I don't have an internet connection.

Solution: carry a fresh version for all platforms on a pendrive, in your wallet.

chmaynard• 8 years ago

The UI in the Mac version has a Windows look and feel, which seems odd. I'm interested in why the developers chose this approach.

_pmf_4• 8 years ago

I think they just use the default GTK theme.

kevinherron• 8 years ago

It's Qt now unless you're on a pretty old version.

Grazester• 8 years ago

I was a network engineer for a University so.

-Used it to discover Cisco switch port number and switch names for ports

-Find rouge routers on the network people setup in their dorm rooms that would hand out their own ip address(DHCP) on our network

asafira• 8 years ago

I have happily used Wireshark during my physics PhD to deal with poor vendor software for various equipment. Example: while Montana Instruments (https://www.montanainstruments.com/) now has a python library for interacting with their cryostats (refrigerators), they didn't always have one, and I just couldn't get their dll's to work. Instead, I sniffed the packets that were being sent back and forth between their provided GUI software and the cryostat, and got things working fairly easily in python thereafter.

Good times.

rosstex4• 8 years ago

Going to shamelessly post a Wireshark tutorial I made when I TA'd the networking class at Berkeley. I think it's a pretty good intro to the tool, and feel free to suggest others too.

https://www.youtube.com/watch?v=jvuiI1Leg6w

chii2• 8 years ago

that was a really good tutorial!

rosstex4• 8 years ago

Thank you!

rickyspanish• 8 years ago

Great tutorial. More importantly though, how did you get that desktop wallpaper?

rosstex4• 8 years ago

Ha, my favorite question. The video is from https://www.youtube.com/watch?v=skI8e5BCozE.

You can use Dreamscene for Windows 7/8. On Windows 10, I used VideoPaper, a free tool from https://www.reddit.com/r/VideoPaper/. It hasn't been updated in a while, so it might not work anymore. Apparently, you can also use VLC to set a video as your desktop background.

fulafel• 8 years ago

My favourite Wireshark link: https://danlebrero.com/2017/04/06/documenting-your-architect...

Generating a sequence diagram of a running system w a bit of Clojure code and PlantUML mixed in.

chii2• 8 years ago

that is actually really freaking cool use case! bookmarked for future reference.

t3h2mas• 8 years ago

Thanks for sharing! I plan on playing around with this soon!

lambda• 8 years ago

One really useful tip for Wireshark that's not as obvious as it should be.

Increasingly often, what you need to debug is a TLS connection. However, that can make debugging more difficult as the contents of the connection are encrypted.

However, if you can access the server key, whether you have access to the production server, or are working in a development environment, or you MITM yourself with mitmproxy, or you're working on some product that ships the same default server keys with every install, you can load the key into Wireshark and then decrypt all of the TLS traffic.

To do so, go to Preferences > Protocols > SSL, and click "Edit" next to "RSA keys list". Then you can load private keys in, and associate them with a host and port, and when you have a TLS connection on that host and port, Wireshark will decrypt the traffic and you can see the inner protocol.

https://wiki.wireshark.org/SSL

Note that this doesn't work if you use a cipher suite with forward secrecy, though it looks like there is support for that as well if you enable logging of ephemeral keys in your client or server (https://security.stackexchange.com/questions/35639/decryptin...)

rosstex4• 8 years ago

This is supported with Firefox and Chrome. Here's how to set it up: https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...

lozaning• 8 years ago

Also if the security model where you work is like where I work and they wont give you the certs, but will allow you to add your own cert, Charles Proxy works a charm.

Crazy useful for sending server side errors to mobile apps to simulate failure that otherwise wouldn't be replicable on demand in a production environment.

plq• 8 years ago

Crazy useful for sending server side errors to mobile apps to simulate failure

That's what test suites are for.

xorcist2• 8 years ago

If you get a mitmproxy working, you probably won't need the Wireshark bits. Getting ephemeral keys out can be tricky and might not even be worth the trouble.

Sometimes I find it convenient to redirect traffic with iptables. That way, if I can classify which traffic interests me, only that traffic will pass through the proxy for inspection. A warning though, SSL specific problems tend to go away when being looked at that way :).

A third method I know people use is LD_PRELOADing a hook in the application to dump keys (search for sslkeylog.c for an example) but that's far too exciting for me to try in production. Between these three methods I tend to reach for the proxy first.

kingosticks• 8 years ago

There's also a fun example of the third method at [1] which is used to decrypt and dump traffic from the official Spotify app for inspection in wireshark. This is used to reverse engineer their protocol and reimplement it in librespot (and various ports of that).

[1] https://github.com/librespot-org/spotify-analyze/blob/master...

syntaxing• 8 years ago

I never understood how to intercept another device's TCP packets. Do you connect some sort of device in between the device and the network as a node or is the only requirement is to be connected in the same hub? Does anyone have reading material on how to do this?

TheAceOfHearts• 8 years ago

I telnet into my router and run tcpdump, then I use FTP to copy the file from the router to my computer and import it to Wireshark in order to inspect it.

DaOne256• 8 years ago

You must connect an old network hub to the device you want to listen to (or its Wifi access point) and your PC that is running WireShark. A hub is like a switch that sends every received data to all of its ports.

johngalt• 8 years ago

Either you run wireshark directly on the endpoint, or you setup some means of tapping into the traffic.

The most common method is to use a managed switch to setup a mirror port. Basically you tell the switch to copy all traffic and send it out on an extra port and then capture traffic while connected to that port.

planteen• 8 years ago

Wireshark has a document: https://wiki.wireshark.org/CaptureSetup/Ethernet

I personally use a hub. You are limited to 10 or 100 Mbps (no gigabit hubs exist). I typically am debugging embedded systems, so inserting a hub into the mix is trivial and easier than trying to login to a managed switch. No tracing in the data closet or calls to IT required.

pnutjam• 8 years ago

A hub will limit your speed significantly. They aren't usually bidirectional. I used to use a linux PC with multiple ports. You can enable port forwarding and capture traffic as it passes through. Use a 3rd port to access it. However, I've recently acquired a managed 5 port switch. I didn't know these were available, but they are awesome and pretty cheap. Example: https://www.amazon.com/TP-Link-Ethernet-Sheilded-Replacement...

brandonsometig• 8 years ago

Port mirroring on most managed switches will allow you to pick up TCP packets for another device.

berti2• 8 years ago

There is a such a thing as an Ethernet tap (basically, you tap one pair to Rx on a NIC, and if you want both ways you need another NIC)... but it's tricky to avoid impedance mismatch etc, and not feasible at all for Gigabit Ethernet. The simple/easy option is configure port mirroring on your switch[1] as mentioned by other commenters.

[1] https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2...

zwieback• 8 years ago

Great for wireless debug as well. We had an issue in the early days of WPA and Wireshark was one of the first open apps to support sniffing and decrypting WPA traffic. We also used Omnipeek, which had a better GUI and better promiscuous and monitor support but Wireshark caught up and now it's my go-to tool.

Filter syntax is a headache, though, if I remember correctly it's totally different for capture and display. I have to go to the manual every time I use wireshark.

cmurf• 8 years ago

Bluetooth? Is Wireshark is useful for troubleshooting dropped connections between mouse and host controller? So far hcidump and bluetoothd debugging aren't revealing why I keep getting dropped connections, but only on Linux. I don't have the same problem with Windows 10 and the same hardware setup. But off hand it seems like Wireshark would produce a ton of really verbose data.

ouchjars• 8 years ago

Wireshark can open streamable multimedia files too. I've used it in contexts completely outside networking to inspect a podcast file that played weirdly and an ancient MP3 mix that turned out to be two files with different sample rates concatenated together so media players didn't seek properly in it.

stuxnet79• 8 years ago

Wow! Can you elaborate more on the latter? How were you able to figure that out with Wireshark?

alexpotato• 8 years ago

Every time someone posts about wireshark, I think it's good to post about tcpflow.

What is it? In short, it shows you the TCP packets as opposed to the raw IP packets. If you are doing protocol analysis or debugging, it's AMAZING!

https://linux.die.net/man/1/tcpflow

gsich• 8 years ago

Important filter: !(tcp.len==0)

krylon2• 8 years ago

That blog is a treasure trove! Her writing style is great, very accessible, even if you are a newbie to the subject, and her enthusiasm is infectious!

partycoder• 8 years ago

To follow a specific TCP connection I rather do this: 1. select message from a connection, 2. Follow -> TCP Stream.

Another thing that helps is to just write a display filter expression, like 'tcp.port eq 443 and ip.dst==1.2.3.4'

https://wiki.wireshark.org/DisplayFilters

jimpudar• 8 years ago

Hansang Bae, the CTO of Riverbed (Wireshark's corporate sponsor) has a series of videos about using Wireshark. There are some great practical packet analysis tips in these.

https://www.youtube.com/watch?v=U0QABcTD-xc&list=PLnKJHZhW_B...

simonebrunozzi• 8 years ago

Slightly off-topic: I personally know the co-creator of Wireshark, Loris Degioanni (https://thenewstack.io/author/lorisdegioanni/), a super-brilliant engineer from Italy. I am wondering why the Wikipedia article doesn't mention him. (I know his co-authorship is true).

How I use Wireshark

Related Stories