SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Understanding Network Packet Specification in Tcpdump, Wireshark, and Snort

palti avatar
palti
18 diapositives · 360 Views · Oct 01, 2014

This guide provides an overview of the common methods for specifying network packets using tools like Tcpdump, Wireshark, and Snort. It covers key functionalities of packet generators such as Ping, Hping, Traceroute, and Nmap, as well as insights into the anatomy of various packet headers (ICMP, IP, TCP, UDP). It also discusses Tcpdump options, Snort configuration, and how to formulate effective Snort rules for intrusion detection. Understanding these concepts enables effective network monitoring and analysis.

#understanding network packet specification in tcpdump, wireshark, and snort #understanding network packet specification in tcpdump, wireshark, and snort ppt #powerpoint #presentation
Understanding Network Packet Specification in Tcpdump, Wireshark, and Snort - slide 1
01 / 18Understanding Network Packet Specification in Tcpdump, Wireshark, and Snort
1 / 17

Télécharger la présentation

Understanding Network Packet Specification in Tcpdump, Wireshark, and Snort
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Monitoring Tools

  2. Focus Question What are the common ways of specifying network packets used in tcpdump, wireshark, and snort?

  3. Packet Generators • ping – test network connectivity - icmp • hping – sends TCP/IP packets to network hosts • traceroute – probes network connectivity • telnet – connects to various ports • nc – establishes tcp and udp connections • sock – acts as arbitrary client and server • nmap – security port scanner

  4. Packet Sniffers • tcpdump – command-line tool for capturing packets. • wireshark – graphical sniffer and packet analyzer. • snort – packet sniffing and network intrusion detection

  5. Packet Anatomy • ICMP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 TYPE= CODE= Checksum DATA ::: (depends on Type and Code and is variable in length – some logged

  6. Packet Anatomy • IP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Version IHL TOS=, PREC= Total Length: LEN= Identification: ID= Fragment Offset: FRAG= Flags TTL= PROTO= Header Checksum Source Address: SRC= Destination Address: DST= Padding Options: OPT=, (not decoded, requires –log-ip-options)

  7. Packet Anatomy • TCP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Source Port: SPT= Destination Port: DPT= Sequence Number: SEQ=, (requires –log-tcp-sequence) Acknowledgment Number: ACK=, (requires –log-tcp-sequence) WINDOW= RES= ECN SYN,ACK… Data Offset URGP= Checksum Options: OPT=, (not decoded, requires --log-tcp-options

  8. Packet Anatomy • UDP Header information 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Source Port: SPT= Destination Port: DPT= Length: LEN= Checksum

  9. Common tcpdump Options • tcpdump [-options] [expression] • c count# exit after count packets captured • iifc # interface to listen on: eth0, lo … • s snaplen # number of bytes to capture/packet • w filename # save output to filename (binary) • e # include the frame header info. • n # don’t convert addresses to names • x # print data of each packet in hex • v # verbose mode expression: [tcp|udp] [dst|src] [host|net|port] id

  10. Wireshark

  11. Wireshark

  12. Snort • Components • Binary: /usr/sbin/snort • Configuration: • /etc/sysconfig/snort • /etc/snort/snort.conf • /etc/snort/*.rules • Logging: • /var/log/snort • /etc/logrotate.d/snort

  13. Uses of Snort • Packet sniffing: • snort –vde • Packet Logging mode: • snort –vde –l ./log # log is a directory • snort –vde –l ./log –h 192.168.1.0/24 • snort –b –l .log # logs in binary format • Intrusion Detection: • snort –d –l /var/log/snort –c /etc/snort.conf

  14. The Snort Engine Packetacquisition Detection Engine Packet decode Preprocessors Log orAlert? Yes Output plugins No Finished Next Packet

  15. Writing Snort Rules • Figure out what is “bad” • Capture traffic that includes the “bad stuff” • Learn the protocol • Figure out why the “bad stuff” is bad • Write a rule • Test the rule • Goto 5.

  16. Rule Format – basic rule alert tcp 192.168.1.2 any -> 192.168.1.3 80 (msg:”your message”;content:”blah”;sid:10001;) • Other keyword:value pairs • - reference:url,www.cabrillo.edu - rev:# - priority:# - classtype:type( see classification.config) - nocase; - depth:# - offset:#

  17. Review

  18. Focus Question What are the common ways of specifying network packets used in tcpdump, wireshark, and snort? • Network packets are most often identified by IP address, network address or port number • Keywords: host, net, and port are used to describe the the above identifiers. If no keyword is specified, host is assumed. e.g. net 192.168.1.0/24 or port 22 • Direction keywords: src and dst can be used with with logical operators: and, or, not. e.g. src host 192.168.1.5 and dst port 22