Analyzing End User and

Application Behavior

Chris Greer
NETWORK ANALYST

@packetpioneer www.packetpioneer.com
st
h
ns

Module How Packets Are Encapsulated

Overview
Identifying Client Conversations
Creating and Applying Display Filters
Top 10 Wireshark Filters for Analysis
Analyzing End User and Application
Behavior
How Packets Are Encapsulated
 How Packets Flow

Servers
Client

Network
 Frame Encapsulation

Data

Data TCP

Data TCP IP

Data TCP IP ETH

FRAME (Packet)
 Packet Anatomy: Ethernet

Dest MAC Source MAC Ethertype Data FCS

Ethernet Header Ethernet FCS

 Packet Anatomy: IP

Ethernet Version/Flags/TTL Src IP Dst IP Data FCS

IP Header
 Packet Anatomy: TCP

Ethernet IP Src Port Dst Port Flags/Window/Options Data FCS

TCP Header
 Packet Anatomy: Payload

Ethernet IP TCP Data FCS

Payload
st
h
ns

Demo
Dissect a Packet in Wireshark
- Use the Lab 1 Trace File
Identifying Client Conversations
 Identifying Client Conversations

Servers
Client

Network
Using Wireshark Statistics
Using Wireshark Statistics
st
h
ns

Demo
Analyze Client Conversations
- Use the Lab 2 Trace File
Creating and Applying Display Filters
Filter out the Madness!
 Two Ways to Filter

Right Click Filtering Syntax Filtering

Filtering on IP Conversations
Filtering on TCP Conversations
st
h
ns

Demo
Creating and Applying Display Filters
- Use the Lab 3 Trace File
Top 10 Wireshark Filters for Analysis
 Common Wireshark Filters

ip.addr == 10.0.0.1
tcp.port == 443
tcp contains pluralsight
dns or tcp
ip.addr == 10.0.0.1 and tcp
!(arp or stp or cdp or lldp)
sip or rtp
tcp.analysis.flags && !tcp.analysis.window_update
tcp.flags.reset == 1
tcp.time_delta > 1
st
h
ns

Demo
Top Display Filters
- Learn how to add them as buttons
Analyzing End User and
Application Behavior
 Typical Client Flow

Servers
Client

Network
Mapping Application Flow

Databases

App Tier
st
h
ns

Module Understanding How Packets Work

Overview Identifying Client Conversations

Creating and Applying Display Filters
Top 10 Wireshark Filters for Analysis
Analyzing End User and Application
Behavior