Solved

Wireshark Help

Posted on 2010-09-13
8
2,079 Views
Last Modified: 2012-05-10
Afternoon all,

I need some assistance with Wireshark if anyone is available?

Quick summery:
We have a client network of more than 1000 machines on 3 VLANS, all should be patched with latest MS patches and is running ESET, however one machine (or more) is infected with Conficker and occasionally 'bursts' through the network. ESET detects and stops the reinfection, but obviously each time a warning comes up the client freaks and goes into a panic.
Unfortunately the ESET logs (on server and client) does not contain any info on the source of the infection even with logging set to Level 5.

I'm looking to use something like Wireshark to sniff the network and hopefully identify the machine(s) in question so I can clean/patch it but my Wireshark knowledge is very limited.

If anyone can help that will be greatly appreciated!

PS.
I've already tried the McAfee/Retina network scanners, ESET conficker remover on logon scripts etc etc..
0
Comment
Question by:benthomas
  • 5
8 Comments
 
LVL 6

Accepted Solution

by:
itnetworkn earned 500 total points
ID: 33662051
I assume you are asking how to use and setup Wireshark. I'm not sure what type of switches you are using, but create a "monitor" port, and you can capture network activity by plugging a NIC into the "monitor" port. When you create the monitor port make sure that it monitors all VLAN's. From within Wireshark, you can filter activity to narrow down the culprits.
0
 
LVL 10

Expert Comment

by:ddiazp
ID: 33672565
Hi benthomas,

Using wireshark, you will only detect this kind of packet if the infected machines issue broadcast packets as a result of the infection, since that's what the machine with wireshark would receive. Additionally, assuming you have over 300 hosts per VLAN, it will be hard to detect specific infected machines unless the number of broadcast messages they generate is high. It would also be helpful to identify what kind of protocol is used when the machines 'bursts' through the network since we can filter it through wireshark.

Now, does this burst affect all 3 VLANs? how often does it happen? Your network engineer might be able to help since he can SPAN many switchports into another one and wireshark that specific port to detect non-broadcast bursts. He might also be able to detect these bursts and where they come from by looking at interface counters.

When these bursts happen, how long does ESET take to detect and stop the burst?
0
 
LVL 6

Expert Comment

by:itnetworkn
ID: 33695537
I think I answered your question. Is there anything else I can help with?
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 6

Expert Comment

by:itnetworkn
ID: 33702208
Your question was "I'm looking to use something like Wireshark to sniff the network and hopefully identify the machine(s) in question so I can clean/patch it but my Wireshark knowledge is very limited." I believe I answered your question, and even followed up with how I could help further.
0
 
LVL 6

Expert Comment

by:itnetworkn
ID: 33719745
Your question was "I'm looking to use something like Wireshark to sniff the network and hopefully identify the machine(s) in question so I can clean/patch it but my Wireshark knowledge is very limited." I believe I answered your question, and even followed up with how I could help further.
0
 
LVL 6

Expert Comment

by:itnetworkn
ID: 33724589
Southmod - I believe I answered the poster's questions in "http:#33721148". I followed up to ask if I could help further, and did not get a response. I would like to be awarded the appropriate points that were offered in this question. If I can help further I am more then willing to do so. Thank you.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now