If you want to see a Network person fall under their desk in the fetal position, ask them to write a script.
Scripts can get complicated since you have to learn a programming language only to find out afterwards that you learned the ‘old not cool anymore’ language. Then you have to document the script using comments and flowcharts, etc…
Ok, let me show you a single Powershell command that you can write to impress your friends, family and maybe your colleagues. The command is Measure-Command {command}. And here is an example from my video Measure-Command {xcopy 113MB h:\*.* /Y}. Its pretty straightforward; Powershell will record how long it takes to complete whatever command you provide.
In the previous example, it was a xcopy from my local drive to my h: network drive.
The filtering capabilities of Wireshark are very comprehensive. You can filter on just about any field of any protocol, even down to the HEX values in a data stream. Sometimes though, the hardest part about setting a filter in Wireshark is remembering the syntax.
So below are the most common filters that I use in Wireshark. Please comment below and add any common ones that you use as well.
ip.addr == 10.0.0.1 [Sets a filter for any packet with 10.0.0.1, as either the source or dest]
ip.addr==10.0.0.1 && ip.addr==10.0.0.2
[sets a conversation filter between the two defined IP addresses]
tcp.time_delta > .250
[sets a filter to display all tcp packets that have a delta time of greater than 250mSec in the context of their stream. Note, this filter requires TCP Conversation Timestamps to be calculated. To learn to do that, click here.]
tcp.port==4000
[sets a filter for any TCP packet with 4000 as a source or dest port]
tcp.flags == 0x012
[displays all TCP SYN/ACK packets - shows the connections that had a positive response. Related to this is tcp.flags.syn==1]
ip.addr == 10.0.0.0/24
[Shows packets to and from any address in the 10.0.0.0/24 space] frame contains traffic [displays all packets that contain the word ‘traffic’. Excellent when searching on a specific string or user ID] !(arp or icmp or stp) [masks out arp, icmp, stp, or whatever other protocols may be background noise. Allowing you to focus on the traffic of interest]
eth[0x47:2] == 01:80 [This is an example of an offset filter. It sets a filter for the HEX values of 0x01 and 0x80 specifically at the offset location of 0x47]
tcp.analysis.flags && !tcp.analysis.window_update
[displays all retransmissions, duplicate acks, zero windows, and more in the trace. Helps when tracking down slow application performance and packet loss. It will not include the window updates, since these aren't really important for me to see in most cases.]
So there are a few of my favorite Wireshark filters. There are a ton more that I use, but these are the big ones. How about you? What are your most commonly used filters?
Not all world records are cause for celebration—just look at the DDoS attack numbers from 2020. For the first time in history, we observed more than 10 million DDoS attacks in a single year, with NETSCOUT’s ATLAS Security Engineering and Response Team (ASERT) observing 10,089,687 attacks over the course of the year. That’s nearly 1.6 million more attacks than 2019’s count of 8.5 million.
Granted, DDoS attack numbers move only in one direction—up. But context is important when looking at DDoS statistics from 2020. From March until the end of the year, DDoS attackers operated amidst the COVID-19 pandemic. While most of the world saw an unprecedented global health crisis, malicious actors saw new vulnerabilities and opportunity. It is seldom that annual activity is so deeply affected by one event, but such is the case with 2020 DDoS attack activity and trends. It is no coincidence that this milestone number of global attacks comes at a time when businesses have relied so heavily on online services to survive.
The start of the pandemic lockdown ushered in a “new normal” in the way we live a......
I’ve received a lot of feedback from my readers expressing their gratitude that my articles/videos are short and to the point. To those people who took the time to send their feedback, thank you.
One topic that I’ve been asked to cover lately is TCP sequence number analysis. There are many videos out there that are very good. I know, since I watched quite a few of them ;)
After watching 4 or 5 of these videos, I noticed that they weren’t geared towards analysts getting into this level of analysis for the first time and missed a few items that I would have added. So here you go.
In this video I briefly’ cover some of the TCP sequence tips and tricks that I use in the field. The important part is to remember that by default Wireshark will display the relative sequence number. It even displays that note in the detail (middle) pane. You can easily toggle this on and off by right clicking on the TCP sequence number (or anywhere in the TCP header), select Protocol Preferences and check/uncheck Relative Sequence numbers.
I also briefly mention that you can also use the netstat –s command from the command prompt to track lost packets by looking at the TCP Segments Retransmittedcounter.
The point of the video is to provide a simple introduction so the whole process of TCP analysis becomes a bit more straightforward.
As an engineer, I’m often accused by my non-engineer brethren of being overly analytical. I confess that I can’t help scrutinizing some things (well...most things) to try and figure out how they work. This can lead to satisfaction and a boost in self-assurance when things work as expected, and a compulsive drive for further analysis when they don’t. I have been blessed (cursed?) with this inclination for as long as I can remember. I have been formally trained for it in school and throughout my career. Reinforced by a lifetime of use, this habit is unlikely to ever change.
