Cyber Command Analysis Insights Efficient

Introduction

In this lab, you will learn how to utilize the command-line interface (CLI) of Wireshark (tshark), a powerful network protocol analyzer. By mastering the tshark, you can streamline your network analysis workflows, automate tasks, and gain deeper insights into network traffic. This lab will guide you through various command-line options and scenarios, equipping you with the skills to efficiently analyze network captures and troubleshoot network-related issues.

Skills Graph

Capturing Network Traffic With Wireshark CLI (Tshark)

In this step, you will learn how to capture network traffic using the Wireshark command-line interface (tshark).

1. Wireshark provides a versatile CLI tool called tshark that allows you to capture network traffic directly from the terminal. This can be useful for real-time monitoring or capturing traffic on remote servers. You should install tshark use the following command:

   sudo apt install tshark

2. To capture network traffic using tshark, you can use the following command:

   tshark -i <interface> -w <output_file>

   Here's a breakdown of the options:

   • -i <interface>: Specifies the network interface to capture traffic from. Replace <interface> with the name of your network interface (e.g., eth1).
   • -w <output_file>: Specifies the output file where the captured traffic will be saved. Replace <output_file> with the desired file name and path (e.g., /home/labex/project/capture.pcapng).

3. For example, to capture traffic on the eth1 interface and save it to a file named capture.pcapng in the /home/labex/project directory, you would run:

   tshark -i eth1 -w /home/labex/project/capture.pcapng

   tshark will start capturing network traffic and display a summary in the terminal.

4. While capturing traffic, you can open another terminal window and generate network traffic to observe the capture in real-time. For example, you can use curl to send an HTTPS request:

   curl https://labex.io

5. After sending the request, you can switch back to the terminal which is running tshark and stop the capture by pressing Ctrl + C. The captured traffic will be saved to the specified output file (capture.pcapng).

Filtering Network Traffic With Wireshark CLI (Tshark)

In this step, you will learn how to apply filters to network traffic captures using the Wireshark command-line interface(tshark).

1. tshark allows you to filter network traffic based on various criteria, such as protocol, source or destination IP address, port number, and more. To apply a filter, you can use the following command:

   tshark -r <input_file> -Y <filter_expression>

   Here's a breakdown of the options:

   • -r <input_file>: Specifies the input file containing the network traffic capture. Replace <input_file> with the path to your capture file (e.g., /home/labex/project/capture.pcapng).
   • -Y <filter_expression>: Specifies the filter expression to apply. Replace <filter_expression> with the desired filter expression (e.g., tcp.port == 443 to filter HTTPS traffic).

2. For example, to filter HTTPS traffic from the capture.pcapng file, you would run:

   tshark -r /home/labex/project/capture.pcapng -Y "tcp.port == 443"

   tshark will display the filtered network traffic in the terminal.

3. Now use the command to count the number of packets in the filtered traffic and save the output to a file to simulate our analysis process:

   tshark -r /home/labex/project/capture.pcapng -Y "tcp.port == 443" | wc -l > /home/labex/project/filtered_packet_count.txt

Exporting Network Traffic With Wireshark CLI (Tshark)

In this step, you will learn how to export network traffic captures using the Wireshark command-line interface.

1. tshark allows you to export captured network traffic in various formats, including plain text, CSV, and XML. To export network traffic, you can use the following command:

   tshark -r <input_file> -F <export_format> -w <output_file>

   Here's a breakdown of the options:

   • -r <input_file>: Specifies the input file containing the network traffic capture. Replace <input_file> with the path to your capture file (e.g., /home/labex/project/capture.pcapng).
   • -F <export_format>: Specifies the export format for the network traffic. Replace <export_format> with the desired format (e.g., pcapng for pcapng format, pcap for pcap).
   • -w <output_file>: Specifies the output file where the exported traffic will be saved. Replace <output_file> with the desired file name and path (e.g., /home/labex/project/export.pcap).

2. For example, to export network traffic from the capture.pcapng file to a plain text file named export.pcap in the /home/labex/project directory, you would run:

   tshark -r /home/labex/project/capture.pcapng -F pcap -w /home/labex/project/export.pcap

   tshark will export the network traffic to the specified output file.

Reading Network Traffic from Stdin with Wireshark CLI (Tshark)

In this step, you will learn how to read network traffic from the standard input (stdin) using the Wireshark command-line interface (tshark).

1. tshark allows you to read network traffic from stdin, which can be useful when piping data from other commands or tools. To read network traffic from stdin, you can use the following command:

   cat <input_file> | tshark -r -

   Here's a breakdown of the options:

   • cat <input_file>: Reads the contents of the specified input file and pipes it to the tshark. Replace <input_file> with the path to your capture file (e.g., /home/labex/project/capture.pcapng).
   • -r: Specifies the file to read the network traffic from. In this case, the file is read from stdin.
   • -: Specifies that the input should be read from stdin.

2. For example, to read network traffic from the capture.pcapng file using stdin and save the output to a file named stdin_output.txt, you would run:

   cat /home/labex/project/capture.pcapng | tshark -r - > /home/labex/project/stdin_output.txt

   tshark will read the network traffic from stdin and save the output to the specified file.

Summary

In this lab, you have learned how to utilize the Wireshark command-line interface (tshark) for various network analysis tasks. You gained hands-on experience in capturing network traffic, applying filters, exporting traffic in different formats, and reading traffic from stdin. By mastering these tshark skills, you can streamline your network analysis workflows, automate tasks, and gain deeper insights into network traffic.

Throughout the lab, you practiced capturing traffic using the -i and -w options, filtering traffic with the -Y option, exporting traffic with the -F and -w options, and reading traffic from stdin using the -r and - options. Each step provided detailed explanations and examples to help you understand and apply the concepts effectively.

By completing this lab, you have taken a significant step in enhancing your cyber security skills and understanding the power of Wireshark's command-line interface(tshark). You can now confidently incorporate these techniques into your network analysis and troubleshooting workflows, enabling you to work more efficiently and effectively in the field of cyber security.