Unit 7: Reading captures in Wireshark · Lesson 3 of 6 · 16 min
Statistics at a glance
Summarise a whole capture by protocol, endpoint and conversation before reading single packets.
mission
- You are
- The analyst handed a capture with no context.
- Situation
- Someone drops scan.pcap on your desk and asks what is in it. You want the shape of the traffic before you read a single packet.
- Goal
- Summarise the capture by protocol, endpoint and conversation.
- Hand in
- How many IPv4 conversations it holds and how big the largest one is.
Three zoom levels before any packet
- io,phswhich protocols, how much of each
- endpoints,ipwhich addresses, sending or receiving
- conv,ip / conv,tcpwhich pairs and sessions, in each direction
- single packetsonly now, and only where the summary points
Protocol hierarchy
io,phs shows every protocol and how many frames and bytes it accounts for.
tshark -r layers.pcap -q -z io,phs
===================================================================
Protocol Hierarchy Statistics
Filter:
eth frames:10 bytes:726
ip frames:10 bytes:726
tcp frames:10 bytes:726
http frames:2 bytes:294
data-text-lines frames:1 bytes:161
===================================================================
Endpoints
endpoints,ip lists every address with what it sent and received. Lopsided counts stand out.
tshark -r scan.pcap -q -z endpoints,ip
================================================================================
IPv4 Endpoints
Filter:<No Filter>
| Packets | | Bytes | | Tx Packets | | Tx Bytes | | Rx Packets | | Rx Bytes |
10.20.0.11 240 12960 112 6048 128 6912
203.0.113.50 204 11016 104 5616 100 5400
10.10.0.23 24 1296 16 864 8 432
10.10.0.31 12 648 8 432 4 216
================================================================================
you should see One outside address exchanged 204 packets with web01. The office laptops barely register.
Conversations
conv,ip pairs the endpoints up. Add a filter after a comma to narrow it.
tshark -r layers.pcap -q -z conv,tcp,ip.addr==10.20.0.11
================================================================================
TCP Conversations
Filter:ip.addr==10.20.0.11
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
10.10.0.23:51514 <-> 10.20.0.11:80 4 323 bytes 6 403 bytes 10 726 bytes 0.000000000 0.0174
================================================================================
you should see The -> columns count traffic from the left address to the right one.
defender tip In Wireshark, Statistics, Conversations gives the same table, sortable by any column. Sort by bytes first, then by packets.
Count conversations in a scan
A port scan creates one tiny conversation per port tried.
tshark -r scan.pcap -q -z conv,tcp | grep -c '<->'
106
you should see 106 conversations in a capture that took seconds: the signature of a scan.
What a defender takes away
- 1Summarise first: protocols, endpoints, conversations.
- 2Outliers in packets or bytes are where to start reading.
- 3Statistics take a filter after a comma;
-Ydoes not apply to them.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.