Let's now open another Katcher final one of the easiest ways to check what's been happening in the network
is to analyze the DNS protocol
wireshark allows you to filter the data by selecting something in the packets details pane then choosing
apply as a filter or preparer's filter.
In our case which is the protocol name and the packet type data can be filtered in many different ways.
Let's see how much information we can get from DNS.
We can choose the protocol we're interested in and corresponding field in our case it's source.
When you click on it with the right mouse button and choose preparer's filter option you can create
more complex filters.
Now we can observe the DNS communication of the chosen client after a short time we'll be able to tell
what programs have been running on the computer and what its user has been doing.
The DNS has a protocol that can give us all of this information.
As you can see to connect to a device and then that work you must first get to know its address.
You must first send the request to the DNS server.
Let's see another example.
We've captured data concerning network users.
In this case someone is connected to HTP servers.
To get a general overview of what happens in a capture file.
Let's start with the statistics menu.
We'll examine that HTP statistics and the packet statistics you can apply data filters to the statistics
to in our case.
We will create the statistics based on all the packets the capture file contains the following information.
The client we've chosen sent 144 get packets.
This is 100 percent of the activities performed by the user.
We see the responses below.
Is there something in these responses that may be troubling not necessarily from the security perspective
but from the management perspective.
Let's have a look at the HTP servers responses right now we don't know what service they were or what
happened to the data we see 140 responses out of which there were 80 OK responses and 57 redirection
responses.
Where a server responded to a client that some data had been moved to another location interestingly
not found message of the TTP protocol indicates a client error.
The client wanted to connect to something that doesn't exist the server isn't responsible for the missing
content.
We can analyze the data using various statistics for the same item.
Let's see the endpoint list for TCAP.
It turns out that servers redirected our request not only to different addresses but also to different
ports so we're not able to trace the data.
We managed however to generate a list of IP addresses of hosts that were involved in the communication
from the number of packets generated by the host.
We can guess that the selected addresses the client's computer.
The list contains the IP addresses of all computers.
We were redirected to
let's see what other information we can get from the DNS server.
Let's open a file with the data captured when the computer was starting up.
An interesting experience is to monitor the computers left unattended.
That is those with no one at the keyboard What does a computer do when no one uses the keyboard.
Some of the programs installed on the computer are very chatty.
Particularly interesting is what happened with the computer when it was starting up.
We know that to find out who the computer was connected to we should filter the data for the information
from the DNS protocol.
We can see that the computer has the McAfee antivirus installed on it.
We also see that the program tried to perform an update
next.
There's a query sent to the virtue modem COM server which isn't a McAfee server.
If we did some research about this server we would learn that this is a Web site that virus is connected
to to get instructions concerning further actions.
It was the site used to coordinate attacks.
Normally the detection of such a situation is not all that easy.
But the capture file and the filter on the DNS server will show us all such information.
If you learned the computers you look after connect to the Web sites that you know nothing about.
Check them out and everything will become clear.
To achieve all this we only needed to know how to use wireshark for data capture and how to filter this
data according to simple rules.