Tuesday, July 27, 2021

Using Wireshark Name Resolution to Make Packet Analysis Easier (chris greer)

 Digging through packet traces can be mind-numbing. It can be difficult for our brains to deal with so many IP addresses flying by at line-speed, or even when doing post-capture analysis.


For this reason it is a good practice to learn to use the Name Resolution feature of Wireshark. As we will see in this video, Wireshark is able to use DNS (and other naming protocols) traffic from within the pcap itself to name IP and IPv6 hosts. Where a DNS resolution is not available for a given station, we can configure Wireshark to go get it from a DNS server.


In this hands-on tutorial, you can download the sample packet capture and follow along as you learn how to configure and utilize the Name Resolution feature of Wireshark.


Enjoy!



Wednesday, July 21, 2021

Flashback: Figuring Out Where To Slice a Packet With Wireshark

 There are many scenarios with packet slicing is helpful and possible necessary. I covered this in a previous article Network Protocol Analysis Tip: Packet Slicing (http://tinyurl.com/yb38lw9j).

To summarize, here are some examples or scenarios where you should consider packet slicing:

· The data is not useful or unreadable/encrypted

· To conserve disk space or reduce your trace file size

· Legal issues around the payload of captured packets

· Reduce load on your capture device. Some packet capture tools are less likely to drop packets when packets are sliced.

David K, one of my YouTube subscribers, asked a great question, “… How could one do that? …”. I thought what a great question since there are times when I assume the reader knows how to do this.

In this video I cover how to figure out the packet slicing value for a HTTP GET command and the destination MAC address. From these two examples, the reader should be able to calculate any other packet slice value.

Please keep in mind that you should always go through this process to determine the packet slice value or offset. This offset may change depending on the network or application so don’t assume the packet slice value will remain the same.



Tuesday, July 13, 2021

The Next Normal

 

People love lists. With little effort, you can find the 10 best movies, TV shows, books, albums, songs, plays or cheeseburgers. The 10 best places to visit, live, retire, or attend college are only a few keystrokes away. And of course no list of lists would be complete without mentioning David Letterman’s Top 10 Lists , which can come in handy if you really care about the Easter Bunny’s top 10 pet peeves.


Most of these lists are temporarily useful or entertaining but have little transformative value (except possibly the cheeseburgers). But there is one type of list that pops up from time to time that really hits close to home – the innovations most likely to change the world.

Those who study the efficacy of innovation generally start with a look at previous world-changers, since the past is easier to predict than the future. Picture the ancient alchemist who, while searching for the secret to eternal life, found himself in a flash with no eyebrows or arm hair. The market for an antidote to eternal life was sparse, and it was not until 8th century China that scientists deliberately assembled the ingredients of gunpowder. This is one invention that unquestionably changed the course of the world, a fact that has little to do with Fourth of July fireworks. It was the next normal for warfare.


No one knows for certain if the folklore about Ben Franklin and his kite is true, but the 18th century team that probed the mysteries of electricity included his name alongside those of Edison, Volta, and Tesla (the scientist, not the car). Since then it has become routine to generate, store and transmit electrical energy, and the world has been in the grip of another new normal.


The list of truly disruptive technologies– and the argument over that list – is endless. A quick Google search will return such things as flight, nuclear fission, the microprocessor, x-rays, rubber, iron smelting, the magnetic stripe card and of course the Internet, without which the Google search could never have happened in the first place. Each of us has an opinion based primarily on expectations for their own life.


When I left home for college in the summer of 1968, it was the start of the next normal for my lifestyle. Before long, I was living in an ocean-view apartment (with 4 other guys) and driving a Triumph TR250. The car was sufficiently unique that it was customary for TR250 owners to wave whenever passing on the road. These days, my normal transportation is a Tesla and I have yet to catch a wave from a fellow owner. Electric cars are no longer unique and are quickly becoming the next normal.


On March 16, 2020, I flew home to Santa Barbara after a visit with family in Colorado. When it was time to board the plane at Denver International Airport, the gate agent invited all passengers to come up at once – all seven of us. This was my first direct exposure to the global pandemic which, to date, has claimed over 4 million lives. While there was a short-term scramble for test kits, PPE, and ventilators, what the world desperately needed was a vaccine, the development of which usually requires an arduous 10-15-year process. The record for the fastest conventional vaccine development (for mumps in 1967) was a discouraging 4 years.


Once pharmaceutical company Moderna received funding approval from the U.S. Government, it took them two days to create the necessary RNA sequences to produce the coronavirus spike protein. Thirty-eight days later, they shipped vials of vaccine to the National Institutes of Health to begin early-stage trials. We can only hope that such rapid development of vaccines, based on genetic engineering, is the next normal.


Before messenger RNA became a thing, genetics was unpredictable at best. It was easy to feel grateful to my parents for passing on their excellent eyesight, while cursing the dental weaknesses I inherited. Both of them had high blood pressure in their later years, and it is one thing that my doctor keeps a close eye on. Unlike my parents’ generation, I have access to digital watches, smart phones and countless personal devices that can monitor and report on my vital statistics. It is a simple matter to track the impact of my sodium intake and avoid that tempting cheeseburger and its 1500 life-limiting milligrams. Medical technology continues to advance and longer, healthier lives will surely be part of the next normal.


Electric vehicles, genetically engineered medicines and wellness technology are just three of the innovations that will help form the next normal. I am happy to give up the gas pump, my goal of living to 100 is within reach and thanks to the Internet, the 10 best vegan cheeseburgers are only a few clicks away.



Author Profile - Paul W. Smith - leader, educator, technologist, writer - has a lifelong interest in the countless ways that technology changes the course of our journey through life. In addition to being a regular contributor to NetworkDataPedia, he maintains the website Technology for the Journey and occasionally writes for Blogcritics. Paul has over 40 years of experience in research and advanced development for companies ranging from small startups to industry leaders. His other passion is teaching - he is a former Adjunct Professor of Mechanical Engineering at the Colorado School of Mines. Paul holds a doctorate in Applied Mechanics from the California Institute of Technology, as well as Bachelor’s and Master’s Degrees in Mechanical Engineering from the University of California, Santa Barbara.

Monday, July 5, 2021

Create A Packet Bookmark To Help With Your Protocol Analysis

 I'm surprised how many still haven't heard of this tip/trick, so i thought it was worth a repost.


In this video, I explain how I create a "Packet Bookmark" to help when finding your place in your traces.

This is basically pinging or doing something planned while you capture packets so you can find the packets as a reference.



Wednesday, June 30, 2021

Kafka on the Network - Wireshark Analysis

 This post follows on from my earlier Kafka Basics and Demo blog. This time we take a look at the packets. How does a Kafka producer send a message to a topic? How on earth does a Kafka consumer know that there is a message waiting to be fetched?


In this video, we look at the Kafka protocol basics with Wireshark. We learn how producers and consumers communicate with nodes and, importantly, how we find the packets that match errors in the Kafka log.



Popular post