wireshark, libpcap, packets, packet sniffer

Wireshark [1], the packet sniffer formerly known as Ethereal, is a must-have for system administrators. If you've ever had to troubleshoot a network problem or needed to watch a transaction with a server, then this is the tool for you. Like most (all?) network data capture programs for Linux, Wireshark relies on libpcap, which provides a system-independent interface for capturing packets; therefore, you do not need to write custom routines for every packet sniffer (tcpdump, Snort, Wireshark, etc.). As long as your OS (e.g., Linux, *BSD, HP-UX, Solaris, Windows, etc.) and software support libpcap, you can sniff packets to your heart's content.

Installing libpcap and Wireshark

Libpcap comes with most operating systems, and Wireshark is almost always included (at least on Linux and BSD). Wireshark is sometimes split into two separate packages: one consisting of the back-end utilities like tshark and mergecap, and the other consisting of the graphical user interface (GUI). On Fedora and most related systems, you can simply run yum:

yum install libpcap
yum install wireshark-gnome

Debian is just as easy:

apt-get install libpcap0
apt-get install wireshark

One problem with using a vendor-supplied version of Wireshark is that most vendors ship really old versions of Wireshark (e.g., Fedora 11 ships v1.1.3). However, the 1.2 series (and v1.3.0, which might be out by the time this article prints) has a lot of new features, such as protocol support, bug fixes, and GeoIP integration (more on this later). To build Wireshark from source, you'll need to download it, so you can either pull the latest stable version [2], or, if you're feeling brave, you can get one of the latest automated builds from SVN [3]. Once you have unpacked it, the installation is pretty simple:

./configure
make
make install

To compile Wireshark, you will need to address some dependencies. At a minimum, you'll want libpcap; I also suggest installing GnuTLS, PCRE (Perl-Compatible Regular Expressions), and GeoIP if you want to use any of the advanced features.

Running Wireshark

Unfortunately, to run Wireshark and capture live data, you need to run it as root. Wireshark has had security problems in the past (more on this later) that allow remote attackers to execute code by sending malicious data, which Wireshark processes. Two ways to avoid running Wireshark as root are relatively simple. The first is to use a packet capture program, such as dumpcap or tcpdump, and then later examine the capture files while running Wireshark as a regular user.

The second method is to run Wireshark as root, but within a contained environment. While running Wireshark within a VMware server-based virtual machine, I originally assumed that Wireshark would only see network data to and from that specific virtual machine. Why I thought this isn't clear (just being hopeful, I guess). In fact, because libpcap accesses the kernel and thus the network card at a low enough level, it will see all network traffic to and from that physical interface. Thus, you can run Wireshark in a VM and easily sniff network traffic. The downside of this is that any rogue user with root access to a VM (at least under VMware Server) can see all the network traffic to the underlying physical machine and any guest VM using that interface.

Libpcap Capture Filters

Capturing network traffic on anything but the most quiet of networks is a lot like drinking from a fire hose. The good news is that almost all programs that use libpcap to capture data also accept filter libpcap filter commands (and sometimes, like Wireshark, support their own filters as well). The bad news is that libpcap's filter set is relatively limited, primarily supporting network addresses and ports (because it is protocol aware). At a minimum, you can use it to minimize the amount of data you're writing to the hard drive or forcing Wireshark to process. For example, to capture web traffic in libpcap, you could use the following syntax:

dst port 80 or 443

The tcpdump man page covers libpcap filter syntax in depth.

Protocol Dissectors

What sets Wireshark apart from the rest of the packet-sniffing programs is its large number of protocol dissectors. In effect, Wireshark is able to understand each major network protocol (SSH, Telnet, NTP, etc.) in depth and not only display information in a more friendly format but allow you to filter it with more options. With Wireshark, you can filter not only for web traffic,

tcp.dstport == 80 or tcp.dstport == 443

but also for specific components within an HTTP connection, such as a response code (only show 404 errors):

http.response.code == 404

Or, you can find any cookies containing the string sessionid:

http.cookie contains "sessionid"

HTTP isn't the only protocol that Wireshark understands; at last count, Wireshark had around 1,000 protocol dissectors (although not all are as complete as the HTTP protocol dissector). Unfortunately, these protocol dissectors can also be a significant problem, with around 85 vulnerabilities [4] ranging from simple denial-of-service problems to buffer overflows with code execution.

GeoIP

Wireshark now also supports GeoIP, which is a set of libraries that can be used to query the MaxMind Geographic IP database (basically a list of IPs and networks and the countries they physically reside in). For free, you can get access to the country data, which means you can create filters in Wireshark to show all traffic from a specific country,

ip an ip.geoip.country == "China"

such as China.

Build a Network Recorder

Unless you run Wireshark 24 hours a day, you will have to recreate any problems while examining the network traffic with Wireshark. Or will you?

The good news is that hard drives are ridiculously cheap now (a terabyte is less than US$ 100 for the raw disk space), and each terabyte disk means you can store 30GB per day for 30 days (more if your network is quiet on the weekends). The tshark program makes storing a ring buffer with a set amount of data (100GB worth of traffic, 2TB, etc.) very easy. The -b option

tshark -i eth0 -b filesize:10240 -b
 files:1000 -w if-eth0

monitors the interface eth0 and creates up to 1,000 files of about 10MB each (for a total of 1GB) with timestamped file names (YYYYMMDDHHMMSS):

if-eth0_00001_20090920041232
if-eth0_00002_20090920041252
if-eth0_00003_20090920041258

These files can then be merged by mergecap if traffic you are interested in spans multiple capture files. The advantage of a ring buffer is that you don't need to rotate files, and you can set a maximum amount of data capture and never worry about it accidentally filling up your hard drive.

Another way to capture network data for later analysis is to use the tcpdump tool. Recent versions of tcpdump usually support the -C option, which starts writing to a new capture file after a specified number of bytes, and the -W option, which limits the number of files created by overwriting old ones when it creates the maximum number of files (thus creating a ring buffer).

Note that you don't need to capture all network traffic to create a log that is useful for tracking down problems; simply recording DNS traffic (port 53 TCP and UDP) will help with many security incidents, such as drive-by downloads, which generate DNS queries to strange domains.

On the other hand, you can simply log outgoing port 80 traffic, which will give you a record of all requests (but not the replies, which would be significantly larger). Much like a video camera, it will not prevent security incidents, but it can give you a pretty good idea of what has happened, and with any luck, it will let you know how many systems were affected by an attack.

Update to Upgrade 2.0

Thanks to Jan Andrejkovic for pointing out a tool I missed in my column "Upgrade 2.0" [5]. Fedora ships with a program called Presto [6] that uses DeltaRPMs to provide smaller updates. In my first test, a normal update would have required 972MB of downloads, but with Presto, it was a mere 224MB (pretty impressive savings). Fedora 11 now includes a yum-presto package (not to be confused with the presto package that is a graphics-related engine) that is a plugin for the yum program. Installation is simple:

yum install yum-presto

First, manually update your /etc/yum.repos.d/fedora-updates.repo to include either a baseurl or mirrorurl pointing to a site that carries the presto RPMs (they are signed with the GnuPG key of Jonathan Dieter, so you need to trust him). Alternatively, you can run your own repository and create RPMs with the presto-utils. If you have more than one system, this might be your best bet.

The Author

Kurt Seifried is an Information Security Consultant specializing in Linux and networks since 1996. He often wonders how it is that technology works on a large scale but often fails on a small scale.