A quick tutorial on using tshark - Yenolam …

1 A quick tutorial on usingtsharkRoss MaloneyJanuary 24, 2017 The network sniffing programtsharkis the terminal oriented version of the GUI GUI version was initially calledethereal. Wikipedia states in May 2006etherealwas renamedwiresharkdue to trademark this tutorial ,tsharkwas compiled from version of thewiresharkopen source configuration used for this compile was:./configure --disable-wireshark --with-extcap=nofollowed by standardmakeandsudo make installterminal commands. But iftsharkis availableon the computer you are using , then use it for a new version is not necessary for this Link ViperDynamic IP (DHCP)Netgear GS724Tv4 miniNetgear 1: Network used in the examplesFigure 1 shows the network used in this tutorial . The Toshiba laptop and Mac mini each operated underthe Linux operating system.

2 The D-Link Viper was a model DSL 2900AL connected as aResidentialGatewayto a RJ45 connection port on a NBN connection box and thus out to the Internet. Ethernet port2 of the Viper was connected to the Netgear switch. The Netgear NAS is used later in this simple network maybe. But appropriate for this tutorial . Figure 1 also demonstrates that a diagramof the network being investigated is Getting startedtsharkoperates in one of two modes. It can either capture network activity or examine previouslycaptured data. Before considering each of those activities, some preliminaries Insufficient permissionThe command:tsharkgave the output:Capturing on enp2s0f0 tshark : The capturing session could not be initiated on interface enp2s0f0 (You don t have permission to capture on that device.)

3 Please check to makesure you have suffieient permissions, and that you have the proper interfaceor pipe packet capturedThis indicates to be able to read packets on the network,tsharkshould be run as root. Alternatively,thetsharkcommand could be prefixed Showing all of the computer s network interfacesTo look at the network interfaces on the current computer, the command:sudo tshark -Dwhen executed on theMAC minicomputer of Figure 1 gave the output:Running as user "root" and group "root". This could be enp2s0f02. any3. lo (loopback)4. nflog5. nfqueue6. usemon17. usbmon28. usbmon39. usbmon4 The first entry indicates an ethernet interace (en), on bus 2 (p2), slot 0 (s0), and function 0 (f0). Thisis in line with the new systemd/udev naming convention replacing the eth0, wlan0, etc.

4 Conventionpreviously used. Theanyindicates all network devices connected, whilelois the standard loopbackdevice used with each network interface. Bothnflogandnfqueueare part of for developing network hooks within the Linux kernel. For this computer there are also four usbnetwork interfaces the first of those devices will be used in the All the current network activityThe command:sudo tsharkwill output on the terminal screen the current activity on the network to which the computer execut-ing the command is connected. In most instances it is a repidly changing tabulation too difficult tocomprehend. At least network activity is is the Saving to a file and then reading from itThere are three ways of assisting the comprehension of network activity whichtsharkcan is to watch all activity on the network as it happens.

5 Another is to focus on certain activity oractivities by capturing those activity. This is the subject of Section The remaining way is to store allactivity, or a selection of activities, in a file and later read it for command:sudo tshark -w capture all packets on the network, storing then in the file here it istold to stop by giving a Ctrl-C from the keyboard. A better command would be to nominate the numberof packets to capture. For example, the command:sudo tshark -c 500 -w the next 500 packets and stores them in these commands give the terminal output:capturing on enp2s0f0 with a number on the following line which indicates the current number of packets captured and storedin the file. The of binary contrast, the command:sudo tshark -r the file containing the packet captures.

6 If there are no switches refining how the file is to beprocessed (as in the above command), then the contents of the file containing the packet capture data isprinted on the Modifying defaulttsharkbehaviourThe default behaviour oftsharkcan be adapted to suit purpose. These changes result from switchesspecify filters on the command line which are applied to the execution oftshark. There are switches aredirected at pachet capture, what is displayed on the terminal screen while packet capture is preceeding,and what is printed on the screen when the captured data is being Basic rulesSome basic rules can assist in usingtshark. These rules are:1. No switches on command line gives default behaviour2. If it is not captured, then the packet cannot be examined3.

7 A packet is captured in its entirity4. Parts of a captured packet can be selected for displayedThe contents of the next three sections expand upon these basic filtersIf not told otherwise,tsharkfetches all packets on the reduction in packets fetched, and either displayed on the terminal or stored in a capture file, can bereduced by giving fetch filters on thetsharkcommand line. These filters are given as-fswitches. Ta-ble 1 contains some of those fetch switch options. As shown in Table 1 such parameters can be combinedand qualified by using the three logical operators below the line at the base of the table. Each option isrequired to be included in double quotes around associated address or example of atsharkcommand using fetch filtering is:sudo tshark -f "net "or written another way:sudo tshark -f "net mask "both of which fetch and display on the terminal only network packets from, or to, all network addresseson a low level, the activity along a network such as in Figure 1 is by ethernet packets.

8 All such packetsdo not carry TCP/IP type data although they can be of interest. Atsharksuch as:4sudo tshark -f "multicast or broadcast"fetches such auxiliary worker packets. By re-running this command withmulticastandbroadcastused separately as the-ffetch switch, the relative proportion of these packets on the network can bededuced usingtshark. Alternately, then command:sudo tshark -f "multicast or broadcast" -w be used to fetch both types of packets from the network and have them stored in a file for subse-quence analysis. With the fetch being written into the file, the fetches are not shown on the 1: A selection of fetch (-f switch) filtersSpecifierDescriptionhost4 decimal digit dot separated IP addressneta range of 4 decimal digit dot separate IP addresssrc netfrom a range of IP addressesdstto a range of IP addressesmaskto apply to IP addressarpAddress Resolution Protocolether protoethernet type fieldether dstethernet MAC address of destinationbroadcastbroadcast message across the networkmulticastethernet multicast packettcp portrangehyphen (-)

9 Separated range of TCP port numbersdst portTCP destination port numbertcp portTCP port numberipall IPv4 trafficpppoesall PPPoE trafficvlanall VLAN trafficportTCP port numbernotNOT the followingandlogical AND of the two adjacent parametersorlogical OR of the two adjacent parametersThe fetch switch is only for use with a network capture. I does not work when fetched network data isread from a file. For example, the command:sudo tshark -f "multicast or broadcast" -r generate an error Yank filtersA yank filter is indicated by a-Yswitch. A selection of those available are listed in Table 2. Theseswitches give information on the terminal about network activity current on the network being moni-tored or from a capture file read intotsharkusing a-rswitch. An example command is:sudo tshark -Y " == "5which displays packets on the network being monitored which are addressed to, or are coming from, The command:sudo tshark -Y " == " -r perform the same function on the input stream being read from the fetch 2: A selection of display (-Y switch) packet time of the to which the packet number in the data hex digit colon separated ethernet MAC hex digit colon separated destination MAC decimal digit dot separated IP s IP s IP of the IP source port destination port packet s response code number&&logical AND||logical OR>greater than greater or equal<less than less than or equal==equal to!

10 Logical NOTThe yank switch can be combined with the fetch switch such as in the command:sudo tshark -f "host " -Y " "which fetches all packets going to, or from, shows on the terminal the IP ad-dress of the destination of that rule follows from this combination. When the yank (-Y) switch is used allow (without the-fswitch),then it acts upon the input stream going intotshark. With the-fswitch it acts upon what the-fswitch yank (-Y) switch cannot be used with a write (-w) on atsharkcommand line. This apply withor without the presence of a fetch (-f) switch. However, the yank switch can be used with a fetch (-f)switch if no read (-r) is present. For example, the command:sudo tshark -f "host " -Y " " -r generate an error message fromtshark. The command:sudo tshark -Y " " -w also generate an error advantage provided by the yank switch is the increase logic which can be performed in it in com-parison with the fetch (-f) switch.