Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Wireshark Essentials

You're reading from   Wireshark Essentials Get up and running with Wireshark to analyze network packets and protocols effectively

Arrow left icon
Product type Paperback
Published in Oct 2014
Publisher
ISBN-13 9781783554638
Length 194 pages
Edition 1st Edition
Arrow right icon
Toc

Table of Contents (10) Chapters Close

Preface 1. Getting Acquainted with Wireshark FREE CHAPTER 2. Networking for Packet Analysts 3. Capturing All the Right Packets 4. Configuring Wireshark 5. Network Protocols 6. Troubleshooting and Performance Analysis 7. Packet Analysis for Security Tasks 8. Command-line and Other Utilities Index

Unusual traffic


While it is difficult to anticipate what methods a hacker may use in an attempt to infiltrate a network or host, there are a few things that should probably never happen on a normal, healthy network. Due to their usefulness in testing and conveying error conditions, ICMP packets are a likely target for malicious redirection. Since TCP is the predominant transport protocol in use for most applications, you should look out for abnormalities in TCP headers or payloads that could be a sign of malicious intent.

Some examples of abnormalities to look out for are discussed in the following table:

Suspicious content

Description

TCP bad flags

An illegal or unlikely combination of TCP flags. The SYN, SYN/ACK, ACK, PSH, FIN, and RST flags are normal when they're used in the appropriate places; anything otherwise warrants investigation.

SYN packet contains data

The initial TCP SYN packet should never contain payload data; it is used to establish a session only. Note, however, that...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image