LoveMyTool - Open Community for Network Management and Monitoring

Wireshark: Using Configuration Profiles (by Joke Snelders)

This is a another great feature in Wireshark: Configuration Profiles.
In this article I will show you how to create and use profiles. By sharing one of my profiles I will also show you how easy it is to copy and share existing profiles.

You can use different profiles for different purposes. You can create separate profiles for analyzing capture files, that contain certain protocols or to analyze wireless capture files.
You can also create different profiles for different companies. Thus you only have to save the capture filters, display filters and other settings, that you use for Company A, in the profile for Company A. Those settings don't bother you while working at Company B and using their specific settings.

 Click on image to enlarge

 

Wireshark and SMB2: extract files – part 2 (by Joke Snelders)

This is the second article about extracting files from Wireshark capture files.
The sample file smb2_pdf2_06f.pcap contains the file WP_SMBPlugin.pdf: A tool for capturing SMB files with Wireshark by David Perez & Jose Pico.
The size is 1.48 MB (1.508.939 bytes). This makes it more complicated, but not impossible to extract the pdf.

You can download the files here:
• sample file smb2_pdf2_06f.pcap
• pdf Download WP_SMBPlugin.pdf

Open the file smb2_pdf2_06f.pcap.
Select a packet in the Packet List.
Right-click and select "Follow TCP Stream" in the context menu to open the "Follow TCP Stream" dialog box.

Select the conversation from "10.0.0.11:49208 -> 10.0.0.12:445 (1516006 bytes)"
Select "raw"
Hit "Save As" and save the file as pdf2.pdf.

 Click on image to enlarge

Wireshark and SMB2: extract files – part 1 (by Joke Snelders)

Although Wireshark does not have a nice feature to export SMB2 objects, you can extract transferred files from the capture files.

In this article I will show you how to extract small files, a pdf and a exe, from Wireshark capture files.

PDF
The sample file smb2-pdf_02.pcap contains the file willhackforsushi.com_80211_Pocket_Reference_Guide.pdf from Will Hack For Sushi.
You can download the files here:
• sample capture file smb2-pdf_02.pcap
• pdf willhackforsushi.com_80211_Pocket_Reference_Guide.pdf

Open the file smb2-pdf_02.pcap.
To check if "Allow subdissector to reassemble TCP streams" is turned on, go to:
• right-click Transmission Control Protocol in the Packet Details pane
• Protocol Preferences
• "Allow subdissector to reassemble TCP streams"

 Click on image to enlarge

 

Wireshark: Export SMB Objects (by Joke Snelders)

Wireshark can export SMB objects.
This feature is inplemented in Wireshark in version 1.6.0.

You can download the latest stable release of Wireshark here.

Download the sample file, export-objects-smb_01.pcap, here and continue reading to learn more about exporting smb objects.

Note
You can also export SMB objects during live capture.

 Click on image to enlarge

SplitCap and TShark (by Joke Snelders)

SplitCap is an open source pcap file splitter.
By default it splits a pcap into multiple files based on UDP and TCP sessions. The output is one file per session.
If you have a large pcap file you end up with a lot of output files.
In this case you can use TShark, part of the Wireshark distribution, to get an overview of all the TCP and UDP sessions in the pcap file. You can choose which sessions are important and write only those sessions to a separate output file.

Download
You can download the latest version SplitCap_1-7.zip here.

Unzip the file SplitCap_1-7.zip and run SplitCap.exe.

Note
SplitCap is written in C# using the .NET framework 2.0.
Make sure you have that installed before running SplitCap.

 Click on image to enlarge

PDD - Packet Dump Decode (by Joke Snelders)

PDD is an open-source program created by Srivats.

The main features are:

Click on image to enlarge

You can download pdd, current release pdd-bin-win32-0.2.zip, here.

The SHA1 Checksum is abd6903a930b570854f40ed44927f480ff34232e.

There is no installation required. Just unzip pdd-bin-win32-0.2.zip and run pdd.exe.

Note
You need to have Wireshark installed, because PDD is only a wrapper around Wireshark.

Continue reading and follow along.

Click on image to enlarge

 

Ostinato: Craft and Play Packets (by Joke Snelders)

Ostinato is an open-source program created by Srivats.
It is a  packet crafter and traffic generator, which runs on Windows, BSD, Mac OS X and different Linux distros.

The main features are:
• replay a single packet or a capture file e.g. Wireshark capture file
• edit packets
• build your own packets from scratch
• stream control: configure the number of packets and packet rate

You can download Ostinato, current release ostinato-bin-win32-0.4.zip, here.
The SHA1 Checksum is 0f16ceef5937027db19766d295827b844d27c617

There is no installation required. Just unzip ostinato-bin-win32-0.4.zip and run ostinato.exe.

Notes
• you need to have WinPcap installed, otherwise you cannot transmit packets
• you need to have Wireshark installed, otherwise you cannot "View Capture Buffer"
    url: http://www.wireshark.org/download.html
    url: http://www.winpcap.org/
• you don’t have to download WinPcap separately; WinPcap comes with Wireshark

 Click on image to enlarge

Sysinternals: BgInfo version 4.16 (by Joke Snelders)

 

BgInfo
    small utility – lots of Background Information

BgInfo by Bryce Cogswell is a free utility from the Microsoft Sysinternals Suite.
BGInfo displays system information on the desktop wallpaper.
This is very useful, when you are managing many different computers or virtual machines.
It is in the Sysinternal top 10 download list and you can download BgInfo.zip here.

Next step is to unzip BgInfo.zip.
It is not necessary, but it is convenient to move BgInfo.exe to a folder named BgInfo.
You don't have to install BgInfo; just run BgInfo.exe, click OK and you are in: 24 fields like Boot Time, Host Name, IP Address and Network Speed are displayed by default.
BgInfo writes the information to a new desktop image: BGInfo.bmp.
Every time when you change the settings and hit the apply button, the desktop image is modified.
The file BgInfo.bmp is located at:
C:\Documents and Settings\USER\Local Settings\Temp

It is easy to customize BgInfo. You can for instance add custom fields or change the font color.
It is also useful to create a batch file and add this file to the Start Up folder.
This way the system information will be refreshed at startup.

Click on image to enlarge

Sharkfest'11 (by Joke Snelders)

Have you ever met 350 Happy Sharks?
No?
Then you were not at Sharkfest'11!

 

Wireshark devotees from all over the world travelled on June 13 to Stanford University in California to join the 4th annual edition of Sharkfest. They travelled a long way to learn as much as they could about Wireshark, their favorite tool, and to meet other members of the Wireshark community.
Thanks to the Sharkfest Coordinating Crew for another successful and educational event.

Use HxD to edit capture files (by Joke Snelders)

In my article "Bittwiste: pcap Capture File Editor" I explained how to replace port numbers, IP and MAC addresses.

In this article I show you how to use a hex editor to edit pcap capture files.

You can download HxD, a freeware hex editor, here.

You can use Microsoft Calculator in Scientific mode to convert decimal numbers to hexadecimal numbers or, for instance, an online conversion table.

Here you can find an online IP Address Converter.

Of course, you can download the sample file http.pcap here.

Screenshot
I've opened capture file http.pcap in Wireshark and in the hex editor.
I marked a Destination and Source MAC address, a Source and Destination IP address and a Source and Destination port number in Wireshark Packet Details pane and Wireshark Packet Bytes pane.
I've also marked the same values in the hex editor.

Click on image to enlarge