Using Wireshark to Capture and Filter TCP/IP Data
Darin Swan
CSEC 640
University of Maryland University College I chose to capture my Internet communication session using the pulldown menu “Capture” (the fifth menu item). To start capturing live data, you merely pull down “Capture” and select “Start” from this menu (you can also use the keyboard shortcut Ctrl-E). Once I started the capture function, I merely perused the Internet through my web browser, tried watching a few videos, downloaded content, and tried to generate as many transactions as I could in a small period of time. After I completed my data capture, I entered the keyboard shortcut of Ctrl-E to stop capturing and went to the File menu (first menu item) and selected “Save As” to save my data for later processing. This generated a file with the unique file extension – “.pcapng”
After saving the data, I then began to review the information within the GUI, noting that there were 31,137 packets represented as lines within the data file; quite a few transactions for just a short period of time. Next I noted the various times, sources, destinations, protocols, lengths and info attributable to each transaction and these columns can all be used to manually sort data within the default “Packet List” pane. Packets are color-coded and use default color settings and custom color settings by using the main menu pulldown “View” (the third menu item) and selecting “Coloring Rules…” (Lamping, Sharpe, and Warnicke, 2012, 6.4). Further details can be gathered from packet information in the main GUI by highlighting a packet within the “Packet Details” pane and the “Packet Bytes” pane. The Packet Bytes pane shows ASCII and hexdump information and Wireshark has a “Packet Reassembling” tab here if this information can be assembled from the particular transaction (Lamping, Sharpe, and Warnicke, 2012, 3.20).
To process the data per the assignment, I used the Display Filter in Wireshark, which is accessible in the graphical user interface or GUI from the pulldown menu underneath “Analyze” (the six menu item). Simply sorting the data manually through the “Packet List” pane does not provide the detailed information that an IT professional, such as a computer forensic scientist, would need to gather any intelligence. Once I opened the “pcapng” file I accessed the Display Filters, essentially the GUI for Boolean filtering of data, protocols, IPs, et cetera. Expressions can be built within the GUI or created manually in the “Filter” dialog box using English equivalents such as eq for equal, ne for not equal, and lt for less than. Furthermore, C-like equivalents can be used, as well, such as: “==” for equal, “!=” for not equal, and “