To encounter this, we can use an approach called port mirroring (the discussion of which is out of scope here). The malware may not let allow packet sniffers to run optimally or may completely block them. If you suspect that a virus or a worm has entered the system, it’s not wise to directly install packet sniffers. Such analysis is important considering blackhat hacking,Ĭyber crime, corporate data theft, and other such rising security threats. This section of the Wireshark tutorial will teach you how to analyze network security at the packet level. Now that you have mastered Wireshark’s basic concepts, you will probably be keen to explore its advanced features. We can use the epoch converter online tool to get the date.įig 3: Displaying the date and time information on the router Security-based analysis Accumulating the information (in this case, a Cisco implementation) along with more data leads us to the concept of epoch time. Thus, we start searching for cryptographic information from the packets with filter OSPF (See Quick and dirty Wireshark tutorial).įig 2: Cryptographic information in a packetĪ quick conversion of the cryptographic sequence number (0x2b915351) from hex to decimal gives 730944337. With more information about the router having a RFC 2328 Section D.3 implementation, we conclude that the OSPF protocol contains timestamp information from the system, while Section D.3. On looking through ICMP, we realize that it doesn’t contain any timestamp SMB is also not from the router. The dump file had Internet control message protocol (ICMP), service message block (SMB), and open shortest path first (OSPF) as the prominent protocols.

Our first task is to find the protocol that contains time information.

Here’s how a pcap file looks in Wireshark. This section of Wireshark tutorial will help you analyze packets. Exploring Wireshark’s packet analysis capabilities

Pcap file analysis