Tshark, Wireshark en línea de comandos. (I Parte.)

Ya estudiamos en su momento Wireshark, una herramieta multiplataforma de interfaz gráfico para análisis de red, producto de la evolución de Ethereal. Pero si no queremos usar la interfaz gráfica, wireshark incluye la herramienta Tshark para capturas, análisis de red, etc en línea de comandos. Al usar las librerias pcap, su uso es similar a TCPDump y Windump.

Empezando con Tshark.

Listamos las interfaces:

>tshark -D

1. \Device\NPF_GenericDialupAdapter (Adapter for generic dialup and VPN capture)
2. \Device\NPF_{58C21E09-0C1F-4F85-9463-12328CA28B9A} (3Com EtherLink PCI)
3. \Device\NPF_{209C9E91-9E52-4551-8FE9-3D78AD9AB0FD} (Juniper Network Connect V
irtual Adapter)

Ejecutando Tshark:

>tshark -i2
Capturing on 3Com EtherLink PCI
0.000000 192.168.1.240 192.168.1.240 Broadcast ARP Who has 192.168.1.11? Tell 192.168.1.240
2.339835 192.168.1.201 HewlettP_1e:88:c8 224.0.1.60 IGMP V1 Membership Report
2.973620 192.168.1.30 192.168.1.30 Broadcast ARP Who has 192.168.1.245? Tell 192.168.1.30
2.973737 192.168.1.245 192.168.1.245 192.168.1.30 ARP 192.168.1.245 is at 00:14:22:5f:a9:25
2.973746 192.168.1.30 192.168.1.30 192.168.1.245 DNS Standard query PTR 240.1.168.192.in-addr.arpa
3.058973 192.168.1.245 192.168.1.245 192.168.1.30 DNS Standard query response, No such name
3.474263 192.168.1.30 192.168.1.30 host001 DNS Standard query PTR 201.1.168.192.in-addr.arpa
3.474332 192.168.1.30 192.168.1.30 host001 DNS Standard query PTR 60.1.0.224.in-addr.arpa
3.474691 192.168.1.30 192.168.1.30 host001 DNS Standard query PTR 30.1.168.192.in-addr.arpa
3.474751 host001 192.168.1.245 192.168.1.30 DNS Standard query response PTR HP-DEVICE-DISC.MCAST.NET
3.475016 192.168.1.30 192.168.1.30 host001 DNS Standard query PTR 245.1.168.192.in-addr.arpa
3.475069 192.168.1.30 192.168.1.30 host001 DNS Standard query A HP-DEVICE-DISC.MCAST.NET
3.475239 host001 192.168.1.245 192.168.1.30 DNS Standard query response PTR FIREWALL1
3.475314 host001 192.168.1.245 192.168.1.30 DNS Standard query response A 224.0.1.60

Aplicando filtros:

Como Tshark usa las librerias pcap, podemos aplicar los filtros ya aprendidos para TCPDump y Windump. Para aplicar estos filtros usaremos el comando -f :

>tshark -i2 -f «dst port 80»
Capturing on 3Com EtherLink PCI
0.000000 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP qsnet-workst > http [SYN] Seq=0 Win=64512 Len=0 MSS=1460
0.000318 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP qsnet-workst > http [ACK] Seq=1 Ack=1 Win=64512 Len=0
0.000794 192.168.1.30 3Com_ed:89:c3 67.228.110.120 HTTP GET /bugzilla/userprefs.cgi?tab=email HTTP/1.1
1.256491 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP qsnet-workst > http [ACK] Seq=738 Ack=1658 Win=64512 Len=0
1.257280 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP qsnet-workst > http [ACK] Seq=738 Ack=3508 Win=64512 Len=0
1.299224 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org HTTP GET /bugzilla/skins/standard/global.css HTTP/1.1
1.571152 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP qsnet-workst > http [ACK] Seq=1396 Ack=6277 Win=64512 Len=0
1.571285 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP qsnet-workst > http [ACK] Seq=1396 Ack=8042 Win=64512 Len=0
1.571359 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP qsnet-workst > http [ACK] Seq=1396 Ack=8915 Win=63639 Len=0
1.829680 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP qsnet-workst > http [ACK] Seq=1396 Ack=10962 Win=64512 Len=0

Condicionando las capturas:

Podemos condicionar las capturas atendiendo, por ejemplo, a criterios de tiempo o de cantidad de paquetes capturados haciendo que Tshark finalice la captura cuando deseemos.

• -c Termina la captura hasta n paquetes
• -a Termina la captura hasta n segundos
• -a Termina la captura hasta n Kb.
• –a Yermina la captura hasta n ficheros

Ejemplos:

>tshark -i2 -f «dst port 80» -c 10
Capturing on 3Com EtherLink PCI
0.000000 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP 4382 > http [SYN] Seq=0 Win=64512 Len=0 MSS=1460
0.000407 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP 4382 > http [ACK] Seq=1 Ack=1 Win=64512 Len=0
0.000673 192.168.1.30 3Com_ed:89:c3 67.228.110.120 HTTP GET /bugzilla/report.cgi HTTP/1.1
5.096047 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP 4382 > http [FIN, ACK] Seq=725 Ack=1 Win=64512 Len=0
5.096541 192.168.1.30 3Com_ed:89:c3 67.228.110.120 TCP 4384 > http [SYN] Seq=0 Win=64512 Len=0 MSS=1460
5.096943 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP 4384 > http [ACK] Seq=1 Ack=1 Win=64512 Len=0
5.123580 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org HTTP GET /bugzilla/userprefs.cgi?tab=email&GoAheadAndLogIn=1 HTTP/1.1
6.590758 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP 4384 > http [ACK] Seq=756 Ack=198 Win=64315 Len=0
6.690479 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP 4386 > http [SYN] Seq=0 Win=64512 Len=0 MSS=1460
6.690934 192.168.1.30 3Com_ed:89:c3 bugs.wireshark.org TCP 4386 > http [ACK] Seq=1 Ack=1 Win=64512 Len=0
10 packets captured

Aquí complicamos un poco el filtro y condicionamos la captura para que termine a los 10 segundos:

>tshark -i2 -f «tcp[13] = 2 and port 25» -aduration:10
Capturing on 3Com EtherLink PCI
0.000000 192.168.1.30 3Com_ed:89:c3 192.168.103.240 TCP 4409 > smtp [SYN] Seq=0 Win=64512 Len=0 MSS=1460
1 packets captured

Aplicando los Dispaly Filters o Filtros de Visualización:

Estos filtros lo vimos aquí. Se usan de forma análoga a como lo haríamos con Wireshark. Usaremos para ello el comando -R.

>tshark -i2 -R «tcp.port == 23»
Capturing on 3Com EtherLink PCI
29.264737 192.168.1.30 3Com_ed:89:c3 192.168.108.254 TCP 4462 > telnet [SYN] Seq=0 Win=64512 Len=0 MSS=1460
29.267380 192.168.108.254 Dell_5f:a9:25 192.168.1.30 TCP telnet > 4462 [SYN, ACK] Seq=0 Ack=1 Win=1024 Len=0 MSS=512
29.267423 192.168.1.30 3Com_ed:89:c3 192.168.108.254 TCP 4462 > telnet [ACK] Seq=1 Ack=1 Win=64512 Len=0
29.269452 192.168.108.254 Dell_5f:a9:25 192.168.1.30 TELNET Telnet Data …
29.270779 192.168.1.30 3Com_ed:89:c3 192.168.108.254 TELNET Telnet Data …

Salida Tshark en formato hexadecimal y ascii:

Usamos el comando -x

C:\>tshark -i2 -R «tcp.port == 23» -x
Capturing on 3Com EtherLink PCI
2.198516 192.168.1.30 3Com_ed:89:c3 192.168.108.254 TCP 4510 > telnet [SYN] Seq=0 Win=64512 Len=0 MSS=1460

0000 00 14 22 5f a9 25 00 04 75 ed 89 c3 08 00 45 00 ..»_.%..u…..E.
0010 00 30 fd ad 40 00 80 06 14 ad c0 a8 01 1e c0 a8 .0..@………..
0020 65 fe 11 9e 00 17 59 2e b1 e9 00 00 00 00 70 02 e…..Y…….p.
0030 fc 00 81 e4 00 00 02 04 05 b4 01 01 04 02 …………..

2.201146 192.168.108.254 Dell_5f:a9:25 192.168.1.30 TCP telnet > 4510 [SYN, ACK] Seq=0 Ack=1 Win=1024 Len=0 MSS=512

0000 00 04 75 ed 89 c3 00 14 22 5f a9 25 08 00 45 00 ..u…..»_.%..E.
0010 00 2c fb e4 00 00 fd 06 d9 79 c0 a8 65 fe c0 a8 .,…….y..e…
0020 01 1e 00 17 11 9e 1b 05 d0 00 59 2e b1 ea 60 12 ……….Y…`.
0030 04 00 a7 89 00 00 02 04 02 00 00 00 …………

2.201187 192.168.1.30 3Com_ed:89:c3 192.168.108.254 TCP 4510 > telnet [ACK] Seq=1 Ack=1 Win=64512 Len=0

0000 00 14 22 5f a9 25 00 04 75 ed 89 c3 08 00 45 00 ..»_.%..u…..E.
0010 00 28 fd ae 40 00 80 06 14 b4 c0 a8 01 1e c0 a8 .(..@………..
0020 65 fe 11 9e 00 17 59 2e b1 ea 1b 05 d0 01 50 10 e…..Y…….P.
0030 fc 00 c3 91 00 00 ……

2.203228 192.168.108.254 Dell_5f:a9:25 192.168.1.30 TELNET Telnet Data …

0000 00 04 75 ed 89 c3 00 14 22 5f a9 25 08 00 45 00 ..u…..»_.%..E.
0010 00 3a fb e5 00 00 fd 06 d9 6a c0 a8 65 fe c0 a8 .:…….j..e…
0020 01 1e 00 17 11 9e 1b 05 d0 01 59 2e b1 ea 50 18 ……….Y…P.
0030 04 00 c7 a8 00 00 ff fb 03 ff fb 01 0d 0a 50 61 …………..Pa
0040 73 73 77 6f 72 64 3a 20 ssword:

————————————————————–

En la segunda parte estudiaremos opciones avanzadas que son las que diferencian a Tshark de otros capturadores de paquetes.