Transcription
I. J. Computer Network and Information Security, 2018, 7, 12-22Published Online July 2018 in MECS (http://www.mecs-press.org/)DOI: 10.5815/ijcnis.2018.07.02Ethical Network Surveillance using PacketSniffing Tools: A Comparative StudyIbrahim Ali Ibrahim DiyebPostgraduate Student, IT Department, FCIT, Sana'a University, Yemen.E-mail: ibrahimthiib@gmail.comDr. Anwar SaifHead of IS department, FCIT, Sana'a University, Yemen.E-mail: Anwarsaif.ye@gmail.comDr. Nagi Ali Al-ShaibanyHead of IT department, FCIT, Sana'a University, Yemen.E-mail: Shaibany@yahoo.comReceived: 18 April 2018; Accepted: 16 May 2018; Published: 08 July 2018Abstract—Nowadays, with growing of computer'snetworks and Internet, the security of data, systems andapplications is becoming a real challenge for network'sdevelopers and administrators. An intrusion detectionsystem is the first and reliable technique in the network'ssecurity that is based gathering data from computernetwork. Further, the need for monitoring, auditing andanalysis tools of data traffic is becoming an importantfactor to increase an overall system and network securityby avoiding external attackers and monitoring abuse ofthe IT assets by employees in the workplace. Thetechniques that used for collecting and converting data toa readable format are called packet sniffing. PacketSniffer is a tool that used to capture packets in binaryformat, converts that binary data into a readable dataformat and log of that captured data for analyzing andmonitoring, displaying different used applications, cleartext user names, passwords, and other vulnerabilities. It isused by network administrator to keep the network ismore secured, safe and to support better decision. Thereare many different sniffing tools for monitoring,analyzing, and reporting the network's traffic. In thispaper we will compare between three different sniffingtools; TCPDump, Wireshark, and Colasoft according tovarious parameters such as their detection ability,filtering, availability, supported operating system, opensource, GUI, their characteristics and features, qualitativeand quantitative parameters. In addition, this paper maybe considered as an insight for the new researchers toguide them to an overview, essentials, and understandingof the packet sniffing techniques and their working.Index Terms—Packet Sniffing Tools, Packet Sniffer,Network Vulnerability, Network Analysis, Wireshark,TCPdump, Colasoft.Copyright 2018 MECSI. INTRODUCTIONInformation technology is becoming an integral partand basic of infrastructure for industries andorganizations. With the huge growth and development ofcomputer networks and Internet, the administration andauditing of the data traffic are important for increasing anoverall networked system security and efficiency. Thepacket sniffing is the process of collection data packetsfrom the network as binary data, converts that binary datainto a readable format and analyzes them showing theprotocols used, plaintext passwords, etc., this help thenetwork administrators to monitor and control thecomputer network to overcome the abuse of IT assets anddecrease the risk of an external attacks and computermalfunction. As well as simplify troubleshooting ofnetwork by detecting and recognizing the errors andwrong use of data by disgruntled employees and/orattackers [1].The packet sniffer is either hardware or software piecethat legitimately used by network administrator to capturethe data frames transmitted between network devices. It isconsidered as the important surveillance tool for thecomputer network like camera surveillance monitoring.In some of packet sniffing tools, you can save the data asaudit logs for later use and analysis. Packet sniffing toolsare passive in which they only collect data and do notmake any change or decision upon those data. In otherwords, they only work as an intrusion detection bycollecting and detection of protocols and data withoutprevention. They help in discovering the vulnerabilities inthe network or work like penetration test for the givennetwork [2].The most important topic that related to packet sniffingis network security which is defined as the policies,standards and procedures for monitoring and preventingdenial of computer network services, misuse of IT assetsand resources, unauthorized access, and so on. TheI.J. Computer Network and Information Security, 2018, 7, 12-22
Ethical Network Surveillance using Packet Sniffing Tools: A Comparative Studyimportant factors of network security and access controlare confidentiality, integrity, availability, authorization,authentication, accountability, and integrity. As anexample, authentication process which is the way ofaccess and exchange information between two systems.The old authentication technique is used the user nameand password. The network sniffer scans the packettraffic inspecting on user names, passwords, addressesand plain text data. Further, the packet sniffing toolsguide the network administrator with any undesiredchanges on the computer network such as packet floodingand IP spoofing [3].Furthermore, Packet sniffer prints collected data on thescreen and reports the log of the captured trafficaccording to parameters such as destination address,source address, target port number, protocol that is used.The network administrators can make the depth analysisof traffic to overcome any weaknesses in the network andto simplify troubleshooting of errors. Also, they can savean audit logs for accountability and later use. In addition,detecting plaintext passwords, the abuse of computerresources, all of that can lead to malfunction of computernetwork and decrease the network performance. For all ofthese reasons, network analysis tools or packet sniffingtools are needed [1].There are various objectives for enabling packetsniffing tools, some of them in the following points: They are used by network administrators in analysismonitoring and auditing of network traffic toinvestigate of employees' abuse of IT assets thatlead to prevent violation of polices standards, andprocedures of an industry or organization. Packet sniffers are used as intrusion detection andpenetration test by network applications' developers,programmer, network and security engineers,especially alarm on the network malfunction orattack when the network performance is slow ordown. Help the network administrators to detect thenetwork weaknesses, threats and vulnerabilities forenhancing the overall security of networks. Understanding the different network applicationsthat use Transmission Control Protocol (TCP) andUser Datagram Protocol (UDP), their parameters,payload type, IP, Media Access Control (MAC)addresses, etc.But, the main objective in this research study is tocompare between three different network analysis tools;Wireshark, TCPdump, and Colasoft Capsa by usingdifferent parameters such as Graphical User Interface(GUI), operating systems supported, libpcap library,o,pen source Packet Capturing (PCAP) supporting, userinterface, cost, decoding forms, determined abnormalpackets, etc. [1][5].The rest of this research paper is organized as follows.Section II defines vulnerability and attacks of a network.Section III provides an overview of network sniffing thatpresents the packet sniffer components, sniffing workCopyright 2018 MECS13process, and the most types of packet sniffing. Section IVexplains the three packet sniffing tools: Wireshark,TCPDump, and Colasoft tool, explain their features,advantages and limitations. Section V presents theexperimental analysis and filtering methods by usingthese packet sniffing tools. Section VI presents thecomparative study between those three packet sniffingtools. Section VII shows the result and discussion. Finally,the conclusion is given in the section VIII.II. NETWORK VULNERABILITY AND ATTACKSThe vulnerability is the weakness in the protocols,applications and data transferred in the computernetworks. Hence, threats exploit these weaknesses todamage resources, systems and applications. The firstthing that the attackers do it is the reconnaissance of thevictim's network system by gathering vulnerableinformation by using tools such as dig, whois, tracerouteand nslookup as well as packet sniffing tools. Networkscanning is used to find vulnerabilities in the networksystem. Port scan is the process of finding the active portwhen a client requests the server [3].There are two types of network attacks which areactive or passive. Packet sniffing is considered as thepassive attack type in which the attacker monitor andcollect the network's information to obtain thevulnerabilities such as clear-text passwords, routinginformation, financial transactions, emails, Media AccessControl (MAC) addresses, Internet Protocol (IP)addresses, critical and sensitive information that are notencrypted can be obtained via packet sniffing toolswithout the user knowledge. The other type of networkattacks is active attacks in which the attackercompromises the network system by masquerades to theother entity in the network system. IP spoofing, AddressResolution Protocol (ARP) spoofing and MAC spoofingare an examples of active attacks.While the TCPDump, Wireshark, and Colasoft areconsidered as the packet sniffing methods. There aresome tools used for spoofing. ETTERCAP is the toolused for ARP spoofing and poisoning which can beperforming Man-in-the-Middle attack. It requiresselecting the network interface to work on it. After theinterface is selected, the network is scanned for hosts inthe network and hosts are showed from their list in thetool. The packet sniffing tools are used for gatheringinformation from computer network, converting thebinary information to hexadecimal and human readableformat for analysis, diagnostic network failures andtroubleshooting. They are used for detecting errors andabnormal traffic in the network. The networkadministrators are using these tools also to predict theweakness and vulnerabilities in the network by showingthe protocols that are insecure to replace them by strongprotocols [3].In addition, there are various systems and applicationsare used the user name and password which is becomingan integral part of our personal and business life. As anexample of the environment of using user names and/orI.J. Computer Network and Information Security, 2018, 7, 12-22
14Ethical Network Surveillance using Packet Sniffing Tools: A Comparative StudyPersonal Identification Number (PIN) logins are bankingsystems, electronic mails login, All Time Money (ATM),Point of Sales (POS), server login, etc. all of these waysare considered as the sources of computer's networkvulnerability if there is no strong protection of loginmethods. The packet sniffing tools are used efficientlyand effectively to test the weakness of the user names andpasswords login methods. These packet sniffing toolsprovide the network administrator with full details of usernames and passwords that are plain text or not havestrong encryption techniques to take a suitablecountermeasure to solve weaknesses in the networksystem.Moreover, there are many types of password attacksthat make an attackers and hackers to crack passwords.From these types are the brute-force, dictionary attack,malware/key logger, SQL injection, rainbow table attack,and phishing attack. As network administrator, you canuse the packet sniffing application to determine the fieldof the user names and passwords in the data traffic andtest the complexity of the passwords and take anappropriate countermeasure to prevent attackers fromstealing of the passwords, for example, when the networkadministrator shows the passwords contains on acombination of numbers, characters and specialcharacters that is brute force attack type, he must adviceto prevent this type of attack by make the password morecomplex and very long [4].III. NETWORK SNIFFINGThe network sniffing is the process of capturing,monitoring, and analysis of the data traffic travelling inthe network both incoming and outgoing traffic. The toolthat performed this process is called packet sniffer whichis the program that captured traffic either in wirednetwork via the wired or wireless network via the air.Packet sniffer has the benefits of analyzing the traffic,determining and understanding the characteristic of thenetwork, possible malicious and attacks, peak usage ofbandwidth and its availability and finding the unsecuredapplications, data and protocols [1].There are two types of packet sniffing which are eithermonitor mode or promiscuous mode. When the NetworkInterface Card (NIC) is set in promiscuous mode, then thehost is becoming able to sniff all packets. In the monitormode, or sometimes called "rfmon" mode, the NIC doesnot care about the Cyclic Redundancy check (CRC) andthe capturing process is occurred without associating orauthentication, for example between access point andwireless NIC in wireless networks [5].A. Components of Packet SnifferThe packetcomponents.snifferconsistsofthefollowing Hardware: the piece of hardware that used like astandard network adapters. Capture driver: It is critical part of packet sniffer. Ithas the role of capturing data from network eitherCopyright 2018 MECSwire or wireless, filters the particular traffic andprotocols and then store data into the buffer. Buffer stores the captured frames that gathered fromthe network. Analysis and decode: in this phase the network datais displayed in descriptive text format, and analysisis figured for each part of data [4].B. Packet Sniffing TypesThere are some parameters of the classification of thepacket sniffing, as shown in the following points. IP based sniffing: This is the fundamental andcommonly used packet sniffing method. In this waythe network card is set in promiscuous mode forcapturing all packets that passes the network. It usesan IP based filtering, and only the packets arecaptured when they are matching the specified IPaddresses. In general, the IP based filter is not set,so the IP sniffing can capture all packets. IP basedsniffing filter works in non-switched networks. MAC Sniffing: like IP based filter, the MACsniffing filter allows the host captures all thenetwork's packets according to the correspondingMAC addresses. ARP Sniffing: This way is used efficiently inswitched networks. It works little different and doesnot require putting the network card intopromiscuous mode because the ARP packets will besend to us. This occurred for the reason that theARP protocol is stateless [1][2].C. Packet Sniffing Work ProcessThe packet sniffing is worked as in the following steps. Collection in which the packet sniffer gathering andcollecting the binary raw data from the networkinterface either wire or wireless interface. Conversion in which the captured binary data isconverted into readable data format to know theprotocols used and data payload. Analysis of the captured and converted data toextract the protocols that used and analyze theirparameters.Each device in network has NIC's physical address thatuniquely identified. When the device is sending thepacket, it passes on all of the network machines. With theprinciple of shared Ethernet, all machines on network cansee the traffic but not response to that traffic if it does notbelong to that machine.When the NIC sets on promiscuous mode, the machinecan see all traffic on the segment. However, when theNIC puts in promiscuous mode for one machine, the NICtakes and gathers all frames and packets on the networkeven if that frames and packets do not destined for thatmachine, which in this situation called sniffer. The snifferbegins the reading all information entered into theI.J. Computer Network and Information Security, 2018, 7, 12-22
Ethical Network Surveillance using Packet Sniffing Tools: A Comparative Studymachine via NIC [1].As we know, the data travelling as packets or frames,group of compound bits formatted to some specifiedprotocols. For this reason, packet sniffer does not peel theencapsulation layers and decode the traffic according todestination computer, source computer, payload, targetedport number or piece of information exchanged betweentwo computers. The following points are definition forboth shared Ethernet and switched Ethernet. Shared Ethernet: As we know the shared Ethernetenvironment, all machines on the network sharesame cable and alternate using of bandwidth. In thistype, each machine receives the traffic thattravelling via network. In this situation, the networkenvironment placed in promiscuous mode, and eachone of the machines can listen to that traffic. Switched Ethernet: in this case, the network used aswitch instead of the hub which named switchedEthernet. The switch is more intelligent and has thefilters table that forward the traffic at the next timeonly to the intended machine without broadcastingthat traffic to all other machines in the network. Inthis case, the sniffer is not suitable. The switchedEthernet provides better performance, but the NICputting in promiscuous mode does not work. Thenetwork administrators assume that the sniffers donot work in this environment [1].15of libpcap library. The developers designed libpcaplibrary as an independent-platform API to work on avariety of applications and to eliminating the systemdependency for data capturing modules in eachapplication. TCPDump is considered as parsing tool.By default, it intercepted and prints out the summarythat captured from the network; the other features likestorage are performed by specified commands.TCPDump works as: 1) Read/Write the captured filefrom network in the Packet CAPture (PCAP) by usingCLI commands. 2) It filters packets according to somegiven parameters. 3) It prints on the screen the captureddata according to the specified parameters [4]. It is moreeasy and portable packet sniffer tool, because it isdepends only on CLI and the network administrators useit to access to the network devices from remote location[5][6].Fig. 1 shows the TCP/IP traffic and its analysis ofTCPDump packet sniffing tool, displaying the addressesand contents of data traffic.There are many packet sniffing applications and toolsavailable in the market. Some of them are graphicalinterface and the other are command line interface. Wewill explain and compare between three popular packetsniffing tools; TCPDUMP, Wireshark and Colasoft.Fig.1. TCPDump Overview shows the TCP/IP Characteristics flow [7].IV. PACKET SNIFFING TOOLSThere are many tools for decoding and analysis of thedata transmitted in the network, usually these tools workunder mode of promiscuous enabling the computercapturing full traffic based on IP packets and ports thatused for variety of applications. The important attentionhere, the sniffing tools are passive and designed for bothwired and wireless networks measurement. In thisresearch paper, we take three packet sniffing tools asshowed in the following points.A. TCPDUMPIt is popular Command Line Interface (CLI), and anopen source packet sniffer tool compatible on Unix andLinux platforms. It was invented in the 1987 at theLawrence Berkeley National Laboratory and afterthat published after few years.It has the libpcap library developed by C programminglanguage that worked to gather network's information.The libpcap provides the interface to all common Unixbased platforms including FreeBSD and Linux. Thelibpcap interface in Windows platform called WinDump.Windump is used the WinPcap which is the windows portCopyright 2018 MECSThe major limitation of TCPDump, it does not providethe network administrator visually GUI of the captureddata for more analyzing, there is only CLI. Since, it is atext based and easy for the user to use it remotely throughTelnet connection. There are other few disadvantageswith TCPDump. These include: Limitations on the analysis of traffic, there is a TCPbased protocols only may be used. It reports only what it finds in packets, if the IPaddress is forged in the traffic, it has no ability toreport anything else [10]. Packets that blocked by the firewall do not beshown.B. WiresharkIt is invented by the scientist Gerald Combs at the lateof 1997 for trucking and recognizing the network'sproblems and monitoring the data traffic. He named itEthereal until in May, 2006 and after that its namechanged to Wireshark. It is an open source software, freeand GUI packet analyzer tool that has written in Cprogramming language and released under GNU GeneralI.J. Computer Network and Information Security, 2018, 7, 12-22
16Ethical Network Surveillance using Packet Sniffing Tools: A Comparative StudyPublic License (GPL). It runs on a variety of Unix-likeoperating systems including Mac OS X, Linux, Solarisplatform, as well as the Microsoft Windows operatingsystem. Command Line Interface (CLI) of Wireshark iscalled TShark to enable the user deal with it viacommands. It is like TCPDump with additional GUI,supporting a variety of protocols and ability of filteringand sorting options. It is used in Network ForensicAnalysis Tool (NFAT) in an organizations.Wireshark is designed for capturing packets from livenetworks and also browsing previously saved captureddata file. The supported format of packet capture is"PCAP" file format. It displays the captured data in a byteand hexadecimal formats showing different types of usedpackets and protocols. It is also allows the user toassemble the packets data into a TCP stream.It has the interface with three panes; the summary paneor packet list panel which shows different capturedpacket analysis like frame number, date, time, destinationand source IP addresses, upper layer protocols, length ofpacket and information of the traffic content with colorfor each captured packet type. The second pane iscaptured packet details. When the packet is determined atthe packet list pane, the details appear in the followingtwo panels; the details and the byte or hexadecimal panes.The details panel is appeared as the tree-like structure ofthe protocols that are captured for a variety ofapplications such as Transmission Control Protocol(TCP), User Datagram Protocol (UDP), Internet ControlMessage Protocol (ICMP), Hyper Text Transfer Protocol(HTTP), etc.,. The third panel is named data or byte panewhich shows raw of captured data displaying the packetbyte in the hexadecimal, ASCII encoding and textformats [8][9][10].The important note here, to run the Wireshark tool, itsets the NIC to promiscuous mode for enabling the snifferto see all traffic on that interface, not just the traffic thataddressed to one of the configured interfaces. Beside thepromiscuous mode, it may be enable the port mirroring toany points of the network when the promiscuous modedoes not coverage all network [5][6].Fig. 2 shows Wireshark interface displaying the threewindows; the summary, details and byte panel, withdifferent characteristics of network's traffic in readablemanner. The section of details shows that the framenumber is 60 bytes, the network type which is Ethernet II,the protocol type is IPv4 and payload content is ARP.The frame size is measured with the MaximumTransmission Unit (MTU) and this unit is determinedaccording to the used network type. For example, theMTU for the Asynchronous Transfer Mode (ATM) is 53bytes [17], the MTU in the Ethernet and IPv4 network is1500 bytes and there is other network types use of jumboframes that reach to 9000 bytes [18]. Hence, the framesize changes according to MTU in a given network type.Copyright 2018 MECSSummarySection of DetailsHexadecimal ContentFig.2. Wireshark Packet Sniffing Tool Interface.Furthermore, the frame size also determine accordingto the used application in the network. In this case study,it is 60 bytes in which the ARP is used to find thephysical link-layer address of a router interface or hostwhen its logical IP address is given. Another example, theauthor [19] used the frame data size of 500 bytes byapplied Quality of service (QoS) on some UDP-basedhealthcare applications and concluded that is suitable forboth delay and jitter, as well as used some of other QoSthat led to get upon frame size 1500 bytes. Then, theframe is appeared in the packet sniffing tool according toapplication or protocol that used in the network.The Wireshark limitations, it needs the bestunderstanding of the protocol formats, HTTP andCascade Style Sheet CSS language knowledge of the byteformat. It uses the PCAP file format for capturing thetraffic, so it can only capture the packets on the networktypes that support PCAP file format. Anotherdisadvantage is that, because the Wireshark is notautomated tool, it is not support for working of long timemonitoring.C. ColasoftIt is closed source network protocol analyzer tooldesigned to work on business and personal use operatedWindows operating system platform that used by networkadministrator to troubleshoot, monitor, and diagnose thetraffic on computer network. Capsa produces freeeditions of Colasoft tool that is ease of use, real-timepacket analysis, and reliable forensic, in-depth protocolanalysis and it is worked continuously 24/7 networkmonitoring. It has a feature of opening multiple interfacesat single instance, providing the user with graphicalinterfaces and matrix representations [5].It has in-depth analysis of packets showing differentcharacteristics with ability of generating reports, logs andalerting with only voice and electronic mails for thelicensed versions. It has a variety of GUI features,displaying the captured information in graphs, matrix andaccording to each characteristic of the network's trafficshowing each protocol used in the network. Fig. 3 showsthe Colasoft tool and its enhanced GUI features.I.J. Computer Network and Information Security, 2018, 7, 12-22
Ethical Network Surveillance using Packet Sniffing Tools: A Comparative Study17The following steps are applying the Wireshark andColasoft packet sniffing tools on HTTP protocol which isuses the TCP protocol at the transport layer [20]. Toextract and analysis of HTTP protocol, do the followingpoints. Open the browser, run the Wireshark and Colasoftin capturing state, and browsing any web site, herein this case study, we are choosing the web site"http://www.sababank.com/signin.php", and try totype the user name and password login. After thatclose the web site and stop the capturing of thenetwork traffic. Use the filter toolbar for filtering the specifiedpacket, showing the protocols and data content.Fig.3. Colasoft Packet Sniffing Tool Interface.There are some limitations of Colasoft; it is expensiveapplication, whereas a free version is available, but withrestricted features, for example the free version does notnotify to the user though E-mail and voice channels.Another two disadvantages of Colasoft tool is that, itworks on the Microsoft Windows operating systemplatform only, and it supports only 300 protocols which isconsidered less compared with some other packet sniffingtools such as Wireshark tool [6][8].V. EXPERIMENTAL ANALYSIS AND FILTERINGThe general packet sniffing process is occurred viathree steps; first, the sniffer is gathered or captured thenetwork's information, second conversion of the capturedbinary data into a readable format, and finally applyinganalysis and filtering of the converted data. There arevarious ways and methods for filtering and choosing thespecified protocol or some part of data traffic. The NICinterface of the machine that the sniffing tools areinstalled on it must be in promiscuous mode to capture allpackets and frames on all segments of network. Thismachine is called sniffer [11]The filtering process of the currently real time capturedpackets or saved captured packets is considered animportant for analysis and diagnosis of various datatraffic, protocols and applications that are used in thecomputer's network system. From that protocols likeHTTP, ICMP, Domain Name System (DNS), TCP/IP,UDP, Simple Network Management Protocol (SNMP),etc., all of the volume information and losses of packetsare shown in that captured information [12].In addition, these packet sniffing tools; TCPDump,Wireshark, and Colasoft are used for monitoring, analysis,and auditing of the data traffic on the computer networkseither wired or wireless networks. Further, they are usedin penetration test and intrusion detection by observingstrange packets in the network. The network's securitythreats are shown by sniffer in which has the ability ofcapturing all incoming and outgoing data traffic,including the clear-text user names and passwords, andother critical information [13]. The packet sniffersinclude engines for discovering intrusion detection andfor searching on specific types of network's attacks suchas packet flooding and IP spoofing attacks [14].Copyright 2018 MECSFig. 4 is an example of extracting user name andpassword in a Wireshark tool by filtering the HTTPprotocol which shows the clear text user name andpassword as shown in the rectangle box which shows theuser name is "Ibrahim Diyeb" and password is"yemen 123".Thefilteringcommandis"http.request.method "POST"". This filtering is guidethe network administrator to make the remediation forthis vulnerability in specified application by using thesecure protocol such as Hyper Text Transfer ProtocolSecure (HTTPS) or encrypt the content.Fig.4. Wireshark Filtering Showing Clear Text of user Name andPassword.Furthermore, to extract all of TCP connection stream ina file, select the packet that you want, and then right clickon the “Follow TCP Stream” by mouse, the file with allcontent of that packet is appeared.Fig.5. Colasoft Analysis and Filtering Showing Web Site.I.J. Computer Network and Information Security, 2018, 7, 12-22
18Ethical Network Surveillance using Packet Sniffing Tools: A Comparative Studyinterfaces at single instance. The graphs show morevisualization for various network statistics and properties.The Wireshark is limited with these capabilities of GUIand it
The packet sniffing tools are used efficiently and effectively to test the weakness of the user names and passwords login methods. These packet sniffing tools provide the network administrator with full details of user names and passwords that are plain text or not have strong encryption techniques to take a suitable .
