Packet Sniffing

I need a little help with packet sniffing. I'm trying to explain this as best I can. I have a firm working knowledge of TCPIP and network protocols. However, I really don't know how to interprit or decode stuff in a packet sniffer such as Ethereal, Analyzer. I can sense some stuff liike an IPX packet storm.. Duh, but I'm still in the dark about reading packets as a whole.

I want to:
1. Be able to tell if there is a virus moving around on my network causing problems.
2. Tell if I have a faulty NIC
3. Tell if someone is using a hack tool to gain access to my network.

I'm just trying to get a good general understaning of what the symbols mean like ACK, and SYN_SENT, SYN, things of that nature.

When I do a search on the internet, I get very general info. Some places wont say because they think I want to be a hacker. I don't, I just want to be able to interprit a darn packet sniff from a sniffer program.

Please help
LVL 2
haasjohAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

chicagoanCommented:
This would be a full day class, but here some basics:

The most usefull thing a sniffer can provide in a general sense is statistics.
Ethereal is a very basic tool, though there are some analysis tools, they're northing like the kinds of reports you can generate with a commercial prodcut like Sniffer Pro.
http://www.bolthole.com/solaris/networkpacket.html shows what's in a basic packet.

>1. Be able to tell if there is a virus moving around on my network causing problems.
Viruses  per-se can be difficult to detect because they can appear to be a web page script or an email attachments, and may only affect the local system. Some worms use the network for propagation, such as code red and msblaster, and these can be detected with a protocol analyser. What you would see is an abnormal amount of traffic from a host or packets destined for a particular port which is associated with the vulnerability the worm uses. Automated systems called Intrusion Detection Systems use a library of known vulnerabilities to compare packets on the network against and alert you if there's a match. Malware that uses email for propagation will generate a lot of traffic destined for port 25 from hosts that usually wouldn't be sending email directly.

>2. Tell if I have a faulty NIC
You have to have a network card and sniffer that can use promiscuous mode. This captures all data on the network without regard to protocol. Again, statistics will show a lot of packets from a particular mac address and lead you to the machine.

>3. Tell if someone is using a hack tool to gain access to my network.
Again a simple sniffer might be a difficult tool to use for this on a busy network. If it's a vulnerability probe the issues in #1 above would apply. If it's a password cracking attempt at a low rate it would be lost in the background noise. Host based Intrusion Detection is a better tool for this sort of thing as the host concentrated rejected login attempts.

Start with http://www.freesoft.org/CIE/Topics/84.htm and www.sans.org 
The tech support areas of the commercial sniffers might make for some interesting reading as well.





0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jason_DeckardCommented:
Chicagoan has posted some good information for you.  I would like to add that RFCs 791 and 793 are very useful when it comes to interpreting IP and TCP packet headers.

RFC 791: ftp://ftp.rfc-editor.org/in-notes/rfc791.txt
RFC 793: ftp://ftp.rfc-editor.org/in-notes/rfc793.txt


Regards,
Jason Deckard
0
jlindqCommented:
For 1 and 3, check out a network based intrusion detection system with public source, e.g. Snort (www.snort.org)
0
Discover the Answer to Productive IT

Discover app within WatchGuard's Wi-Fi Cloud helps you optimize W-Fi user experience with the most complete set of visibility, troubleshooting, and network health features. Quickly pinpointing network problems will lead to more happy users and most importantly, productive IT.

chris_calabreseCommented:
I'll second jlindq's recommendation to check out Snort.
0
joele23Commented:
I just helped someone with a similar problem here
    http://www.experts-exchange.com/Security/Q_20788052.html

Snort is probably the best answer but as you stated in your original question that you do not want to try to decipher packets.
My tool of choice is PureSecure which has a free personal version. It uses snort as your network sniffer but it also has a mangement console that puts snort in a more readable format, it even decrypts your hex payload into a human readable format when it can. You can get it here http://www.demarc.com
0
TooKoolKrisCommented:
Snort is cool. I also agree with chicagoan comments as well. There are some toolz out there that can recognize what we can call a "data signature". Now a signature meaning that its data packets present repeat patterns. It matters not what is actually contained in the packet whatsoever, simply the pattern of it and the protocol used. You can tell that you have a nasty one when it has the ability to randomize its data signature across the network. This is how the engines in most AV programs work as well; they look for specific data signatures (patterns) in files.

Remember from TCP\IP that every communication that takes place has that 3-way handshake before communication (session) can begin? Those ACK's and SYN's are the establishment of these sessions across the network. Other commands that you see are for control and such. There will also be ones for termination.

The best way to use a sniffer is to filter out what you know should be there i.e. traffic belonging to DHCP, DNS, ect..

Understanding the communications of the client\server part of your network along with your applications and what it looks like through the eyes (or should I say nose) of the sniffer will help you in your quest to achieve skills in the sniffer area. The more you can weed down what you know should be there the better you will be able to identify what shouldn't. You'll know what a broadcast looks like when you see it, you'll know when that Netbus datagram flew across you network.

Here is a site with simular things in mind:
http://www.foundstone.com

Just some thoughts,
HTH
0
chicagoanCommented:
Need more help?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.