Wireshark: Basic Overview & MITM Applications

Introduction to Wireshark

Wireshark is a comprehensive network protocol analyzer designed primarily for network administrators. It provides detailed insights into network traffic, allowing professionals to:

• Monitor network activity in real-time
• Troubleshoot network issues
• Analyze protocol behavior
• Detect anomalies in network traffic

Basic Operation Principles

1. Interface Selection: Choose which network interface to monitor (e.g., Wi-Fi adapter, Ethernet card)
2. Packet Capture: Wireshark logs all traffic flowing through the selected interface
3. Traffic Analysis: The captured packets can be analyzed in real-time or saved for later examination
4. Filtering & Searching: Apply filters to focus on specific protocols, IP addresses, or packet contents

Capture Limitations

By default, Wireshark can only capture traffic that passes through your own computer's interfaces. It cannot directly capture traffic from other devices on the network without special configurations or techniques.

Wireshark Interface Overview

The Wireshark GUI consists of several key components:

Common MITM Techniques

To use Wireshark for capturing traffic from other devices, an attacker must first redirect that traffic through their own machine using techniques such as:

1. ARP Spoofing

ARP spoofing involves sending falsified ARP messages to associate the attacker's MAC address with the IP address of a legitimate network resource (like the default gateway).

# Example of ARP spoofing with bettercap
sudo bettercap -iface eth0 -caplet spoof.caplet

2. Creating Rogue Access Points

Setting up a fake Wi-Fi access point that victims connect to, allowing the attacker to capture all their traffic.

3. DNS Spoofing

Redirecting DNS queries to return malicious IP addresses that route through the attacker's machine.

Example 1: Basic Packet Capture

1. Launch Wireshark (from terminal or applications menu in Kali Linux)
2. Select an interface (e.g., eth0 for wired connection, wlan0 for wireless)
3. Click the "Start capture" button (blue shark fin icon)
4. Generate some network traffic (e.g., browse to websites)
5. Observe the packets being captured in real-time
6. Apply filters to narrow down traffic (e.g., http to show only HTTP traffic)

Example 2: MITM Traffic Analysis with ARP Spoofing

1. Set up ARP spoofing to become the man-in-the-middle

# Using bettercap for ARP spoofing
sudo bettercap -iface eth0
> set arp.spoof.targets 192.168.1.5
> arp.spoof on

2. Launch Wireshark and capture on the same interface (eth0)
3. All traffic to/from the target (192.168.1.5) will now pass through your machine and be visible in Wireshark
4. Apply filters to focus on interesting traffic:
   • http - Show HTTP traffic
   • tcp.port == 80 - Show traffic on port 80
   • host example.com - Show traffic to/from a specific domain

Analyzing Captured Packets

Once packets are captured, you can:

• Follow TCP streams - Right-click a packet and select "Follow" > "TCP Stream" to view the entire conversation
• Extract files - Use File > Export Objects to extract files transferred over protocols like HTTP
• View statistics - Use Statistics menu to generate reports about captured traffic
• Save captures - Save packet captures to files for later analysis using File > Save

Key Takeaways

• Wireshark is a powerful network protocol analyzer designed for legitimate network analysis and troubleshooting
• By default, it can only capture traffic flowing through interfaces on your own computer
• When combined with MITM techniques like ARP spoofing, Wireshark can analyze traffic from other devices
• Always use Wireshark ethically and with proper authorization
• Mastering Wireshark's filtering capabilities is essential for effective traffic analysis