Network Packet Analyzer : 666896

Question:

Discuss about the Network Packet Analyzer.

Answer:

Wireshark, formerly known as Ethereal, is one of the most powerful tools in a network security analyst’s toolkit. As a network packet analyzer, Wireshark can peer inside the network and examine the details of traffic at a variety of levels, ranging from connection-level information to the bits comprising a single packet. This flexibility and depth of inspection allows the valuable tool to analyze security events and troubleshoot network security device issues. It’s also priced right: it’s free!

Wireshark is a robust program that allows for the following:

• Using filters can greatly assist in narrowing data, as Wireshark tends to generate a lot of data that may not all be useful.
• Wireshark can read live data from multiple network types, including Ethernet and IEEE 802.11.
• Wireshark can capture raw USB traffic.
• Wireshark has a GUI for analysis; however it also has a command line version called TShark.
• Data can be captured directly from a live network or read from already-captured packets.
• VoIP calls and their data can be captured from network traffic. If the encoding is compatible, the VoIP media can even be played.

In the scope of a digital forensics-based investigation, Wireshark can be immensely helpful, especially in finding and displaying emails that could be potential evidence. For example, Wireshark can be used to catch a suspect who is stealing a victim’s wireless Internet to make fraudulent online purchases. By using Wireshark as a network monitoring tool, it is possible to find the IP or MAC address of the suspect, and to see what sites he or she is visiting. Additionally, it may be possible to recover emails and other potentially sensitive and incriminating information that the suspect is sending over the network. When used in conjunction with other forensics tools, such as aircrack_ng (a tool that concentrates on examining wireless traffic versus Ethernet), it is possible to enhance the usefulness of Wireshark to make it an effective forensic network analysis tool.

The CSV file is converted into the easily understandable excel file. The same file is attached below.

FORMAT

URI

http://www.linkedin.com

http://www.google.com/url?sa=t&rct=j&q=log%20reduce&source=web&cd=4

http://www.bing.com/search?q=sumo%20logic&src=IE-SearchBox&FORM=IE11SR

http://www.bing.com/search?q=SIEM&src=IE-SearchBox&FORM=IE11SR

http://www.bing.com/search?q=monitoring%20dashboards&src=IE-SearchBox&FORM=IE11SR

http://www.accel.com

http://search.yahoo.com/mobile/s?rewrite=72&.tsrc=apple&first=1&p=sumologic.com&pintl=en

IP

101.92.120.16

147.106.118.104

161.71.8.142

19.174.45.8

34.87.4.6

65.98.119.36

/_downloads/Datasheet.pdf HTTP/1.1

/_includes/follow/follow_us.php HTTP/1.1

/_includes/wp/blog/wp-content/themes/sumologic/style.css HTTP/1.1

/_js/master.1332956664.js HTTP/1.1

/_media/company_logo.png HTTP/1.1

/_media/play_button_gray.png HTTP/1.1

/_media/resource_thumb_video_my_v2_homepage.jpg HTTP/1.1

/aboutus/ HTTP/1.1

/shopping/cart/confirm.jsp HTTP/1.1