Cómo identificar actividades de red sospechosas utilizando Wireshark en Ciberseguridad

Introduction

In the field of Cybersecurity, understanding and identifying suspicious network activities is crucial for maintaining a secure and resilient network infrastructure. This tutorial will guide you through the process of using Wireshark, a powerful network protocol analyzer, to detect and analyze potential threats in your network environment.

Installing and Setting Up Wireshark

What is Wireshark?

Wireshark is a powerful, open-source network protocol analyzer that allows you to capture and inspect data traveling back and forth on a network in real-time. Security professionals use it to:

• Monitor network traffic
• Troubleshoot network problems
• Detect suspicious activities
• Analyze protocol details
• Identify potential security threats

Installing Wireshark

Let's start by installing Wireshark on our Ubuntu system. Open a terminal and execute the following commands:

sudo apt update
sudo apt install -y wireshark

During the installation, you will be asked if non-superusers should be able to capture packets. Select "Yes" for convenience in this lab environment.

The installation may take a few minutes. Once completed, you should see output indicating that Wireshark has been successfully installed.

Setting Up User Permissions

To capture packets without running Wireshark as root, we need to add our user to the wireshark group:

sudo usermod -a -G wireshark $USER

For the changes to take effect, we need to log out and log back in, but for this lab, we can apply the changes immediately with the following command:

newgrp wireshark

Verifying the Installation

Let's verify that Wireshark has been installed correctly:

wireshark --version

You should see output similar to:

Wireshark 3.6.2 (Git v3.6.2 packaged as 3.6.2-2)

Copyright 1998-2022 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.15.3, with libpcap, with POSIX capabilities
(Linux), with libnl 3, with Lua 5.2.4, with GLib 2.72.1, with zlib 1.2.11,
with Snappy, with libpcap 1.10.1, with GNUTLS 3.7.3, with Gcrypt 1.9.4.

Starting Wireshark

Now let's start Wireshark with the graphical interface:

wireshark &

The Wireshark application will open in a new window. You will see the main interface with a list of network interfaces available for packet capture.

Take a moment to familiarize yourself with the Wireshark user interface:

1. The top section shows available network interfaces
2. The middle section (currently empty) will display captured packets
3. The filter bar at the top allows you to filter displayed packets
4. Various menus and toolbars provide additional functionality

In the next step, we will learn how to capture network traffic using Wireshark.

Capturing Network Traffic with Wireshark

Understanding Network Interfaces

Before we can capture network traffic, we need to understand which network interface to monitor. In a typical system, you might have several interfaces:

• eth0 or ens33: Ethernet (wired) connection
• wlan0: Wi-Fi connection
• lo: Loopback interface (local traffic)

Let's check the available network interfaces on our system:

ip a

This command will display all network interfaces. Look for interfaces like eth0, ens33, or other network interfaces (the exact name depends on your system configuration).

Generating Test Network Traffic

To ensure we have some network traffic to analyze, let's generate some basic HTTP traffic by making a few web requests:

## Create a directory to save our captures
mkdir -p ~/wireshark_lab

## Generate some HTTP traffic
curl -s http://example.com > /dev/null
curl -s http://google.com > /dev/null

Capturing Traffic in Wireshark

Now, let's capture some network traffic using Wireshark:

1. If Wireshark is not already running, start it:

wireshark &

2. In the Wireshark main window, find your primary network interface (likely eth0 or ens33 - use the interface you identified earlier with the ip a command).

3. Double-click on the network interface to start capturing packets.

4. You will see packets starting to appear in the main window as they are captured:

   • The top pane shows the list of packets
   • The middle pane shows details of the selected packet
   • The bottom pane shows the raw data of the selected packet in hexadecimal and ASCII

5. Let's generate some more network traffic while Wireshark is capturing:

## Open a new terminal window and execute:
ping -c 5 google.com

6. Go back to Wireshark, and you should see the ICMP ping packets appearing in the capture.

7. To stop the capture, click on the red square button in the toolbar or go to Capture > Stop.

Saving the Captured Traffic

Now that we have captured some network traffic, let's save it for further analysis:

1. In Wireshark, go to File > Save or press Ctrl+S.

2. Navigate to the ~/wireshark_lab directory we created earlier.

3. Name your file basic_capture.pcapng and click Save.

## Verify that the capture file was saved
ls -la ~/wireshark_lab/

You should see your basic_capture.pcapng file in the output.

Opening a Saved Capture

Let's practice opening our saved capture file:

1. In Wireshark, go to File > Open or press Ctrl+O.

2. Navigate to ~/wireshark_lab/basic_capture.pcapng and open it.

The captured packets should now be displayed in Wireshark, ready for analysis.

In the next step, we will learn how to filter and analyze this captured traffic to identify specific types of network activities.

Analyzing Network Traffic with Basic Filters

Understanding Wireshark Display Filters

Wireshark display filters allow you to view only the packets that match specific criteria. This is essential when analyzing large packet captures to find relevant information.

The basic syntax for Wireshark display filters is:

protocol.field == value

For example:

• ip.addr == 192.168.1.1 - Shows packets with this IP address
• tcp.port == 80 - Shows packets with TCP port 80
• http - Shows all HTTP packets

Applying Basic Display Filters

Let's practice applying some basic filters to our captured traffic:

1. Make sure Wireshark is open with our previously saved capture file. If not, open it:

wireshark ~/wireshark_lab/basic_capture.pcapng &

2. Locate the filter bar at the top of the packet list (it says "Apply a display filter..." when empty).

3. Let's filter for DNS traffic. Type the following in the filter bar:

dns

4. Press Enter or click on the blue arrow button to apply the filter.

You should now see only DNS packets in the display. These are domain name resolution requests and responses.

5. Now let's try filtering for HTTP traffic:

http

Apply the filter and observe the HTTP packets.

6. Let's filter for a specific IP address. First, identify an IP address in your capture by looking at the source or destination columns. Then apply a filter like:

ip.addr == [replace_with_an_ip_from_your_capture]

For example: ip.addr == 93.184.216.34 (if you see traffic to example.com)

Combining Filters

You can combine filters using logical operators:

• && or and for AND operation
• || or or for OR operation
• ! or not for NOT operation

Let's try a combined filter:

http && ip.addr == [replace_with_an_ip_from_your_capture]

This will show HTTP traffic only to/from the specified IP address.

Creating a Simple Filter for TCP Traffic

Let's create and save a filter for TCP traffic:

1. In the filter bar, type:

tcp

2. Apply the filter. You should see only TCP packets.

3. Let's save this filter for future use. Click on the "+" button at the right side of the filter bar.

4. In the dialog that appears, enter:

   • Filter name: TCP Traffic
   • Filter string: tcp

5. Click on "Save" to save this filter.

Analyzing Protocol Hierarchy

Wireshark provides a helpful visualization of the protocols in your capture:

1. Go to Statistics > Protocol Hierarchy.

2. This shows a breakdown of protocols by percentage and packet count.

3. Close this window when done reviewing.

Saving Filtered Results

Let's save a filtered view of our capture:

1. Apply a filter of your choice (e.g., http or dns).

2. Go to File > Export Specified Packets.

3. Ensure "Displayed" is selected in the "Packet Range" section.

4. Navigate to ~/wireshark_lab/ and save as filtered_capture.pcapng.

5. Verify the file was saved:

ls -la ~/wireshark_lab/

You should see both your original and filtered capture files.

In the next step, we'll use these filtering techniques to identify suspicious network activities.

Identifying Suspicious Network Activities

Common Indicators of Suspicious Network Activities

When analyzing network traffic for security purposes, certain patterns and behaviors may indicate suspicious or malicious activities:

1. Unusual Port Usage: Traffic on uncommon ports or well-known malware ports
2. Excessive DNS Queries: May indicate DNS tunneling or data exfiltration
3. Unencrypted Credentials: Passwords sent in clear text
4. Port Scanning: Multiple connection attempts to different ports
5. Unusual Data Patterns: Base64-encoded payloads or encrypted traffic where not expected
6. Connection Attempts to Known Malicious IPs: Traffic to/from blacklisted addresses

Simulating Suspicious Activities

For learning purposes, let's simulate some suspicious network activities that we can detect with Wireshark:

## Create a directory for our security analysis
mkdir -p ~/wireshark_lab/security_analysis

## Simulate a port scan (limited to a few ports for demonstration)
nmap -p 80,443,22,21,25 scanme.nmap.org > ~/wireshark_lab/security_analysis/scan_results.txt 2>&1

Note: The nmap command above performs a scan on common ports of the scanme.nmap.org server, which is specifically set up for testing nmap.

Capturing and Analyzing Suspicious Traffic

1. Start a new Wireshark capture on your main network interface:

wireshark &

2. In Wireshark, double-click on your primary network interface to start capturing.

3. In a separate terminal, run the simulation command:

## Simulate another port scan while capturing
nmap -p 80,443,22,21,25 scanme.nmap.org > /dev/null 2>&1

4. After the command completes, stop the Wireshark capture by clicking the red square button.

5. Save this capture as suspicious_traffic.pcapng in the ~/wireshark_lab/security_analysis/ directory.

Detecting Port Scanning

Port scanning is a common reconnaissance technique used by attackers to discover services running on a system. Let's identify the port scanning activity in our capture:

1. Apply a filter to see the connection attempts to different ports:

tcp.flags.syn == 1 && tcp.flags.ack == 0

This filter shows TCP SYN packets, which are used to initiate connections. A large number of these packets to different ports on the same host is indicative of port scanning.

2. To focus on traffic related to our nmap scan, you can add a filter for the target domain:

tcp.flags.syn == 1 && tcp.flags.ack == 0 && ip.addr contains scanme.nmap.org

Creating a Security Analysis Report

Let's document our findings in a simple security analysis report:

## Create a report file
nano ~/wireshark_lab/security_analysis/security_report.txt

Add the following content to the file:

Security Analysis Report
=======================

Date: [Current Date]

Findings:
1. Port Scanning Activity Detected
   - Source: [Your IP address]
   - Target: scanme.nmap.org
   - Targeted Ports: 80, 443, 22, 21, 25
   - Evidence: TCP SYN packets to multiple ports

2. Analysis Method:
   - Used Wireshark to capture network traffic
   - Applied filter: tcp.flags.syn == 1 && tcp.flags.ack == 0
   - Identified pattern of systematic connection attempts

3. Recommended Actions:
   - Monitor for unauthorized scanning activities
   - Implement firewall rules to limit outbound scanning
   - Consider implementing network intrusion detection systems

Save the file by pressing Ctrl+O, then Enter, and exit nano with Ctrl+X.

Creating a Custom Filter for Suspicious Activities

Let's create a custom filter for detecting potential security issues:

1. In Wireshark, type the following filter:

(tcp.flags.syn == 1 && tcp.flags.ack == 0) || (dns.qry.type == 1 && dns.qry.name contains "suspicious") || (http.request && ip.addr == 192.168.0.1)

This complex filter looks for:

• Port scanning activity (SYN packets without ACK)
• DNS queries for domains containing "suspicious"
• HTTP requests to/from IP 192.168.0.1

2. Save this filter:

   • Click the "+" button at the right end of the filter bar
   • Name: Security Monitoring
   • Filter string: (paste the filter above)
   • Click "Save"

3. Export this filter configuration for future use:

## First, open your Wireshark profile directory to find the saved filters
ls -la ~/.config/wireshark/

Summarizing Your Security Analysis

Let's verify our security analysis artifacts:

## List all the files we've created
ls -la ~/wireshark_lab/security_analysis/

You should see:

• scan_results.txt - Output from our nmap scan
• suspicious_traffic.pcapng - Wireshark capture of suspicious activities
• security_report.txt - Our analysis report

These files represent a basic cybersecurity analysis workflow:

1. Capture suspicious traffic
2. Analyze the traffic using appropriate filters
3. Document findings and recommendations

In a real security environment, you would continue to refine your detection techniques, create more sophisticated filters, and integrate Wireshark analysis with other security tools for comprehensive threat detection and response.

Summary

In this lab, you have gained hands-on experience with Wireshark, a powerful network protocol analyzer widely used in cybersecurity. You have learned how to:

1. Install and set up Wireshark on Ubuntu
2. Capture network traffic from various interfaces
3. Apply filters to analyze specific types of network traffic
4. Identify potential suspicious activities like port scanning
5. Document your findings in a security analysis report

These skills form the foundation of network traffic analysis for cybersecurity purposes. By understanding how to effectively use Wireshark, you can monitor network traffic, detect anomalies, and identify potential security threats before they cause significant damage.

As you continue your cybersecurity journey, you can build upon these basics by learning more advanced filtering techniques, developing custom detection rules, and integrating Wireshark with other security tools to create comprehensive network monitoring solutions.