Home > Ask the Information Security Experts > Network security threat management Questions & Answers > When to capture packets with Wireshark
Ask The Security UK Expert: Questions & Answers
EMAIL THIS

When to capture packets with Wireshark

>
QUESTION:
From a security perspective, what are the best scenarios to use a tool like Wireshark to sniff packet data?


RELATED CONTENT
Network security threat management
Is it enough to analyse log files, or is an IDS necessary?
What to look for in a network security audit
How to address a spike in TCP and UDP flows
How secure are extended validation SSL certificates?
What should happen to users and devices that fail NAC policies?
When to use a unified threat management system
Cloud computing network security best practices
When IT security costs are cut, which security product is a must?
What considerations should be made when outsourcing IT infrastructure?
When running Wireshark, will adding a switch stop packet sniffing?

Threat and Vulnerability Management
Microsoft's Charney details new botnet protection, IdM technology at RSA
Look into SIEM services to cut costs, comply with PCI DSS, HIPAA
Cloud security issues, targeted attacks to be hot-button topics at RSA
Zeus Trojan continues reign infecting 74,000 PCs in global botnet
How to use Google Webmaster tools to help protect your site
New Community Security Policy aims to reduce computer misuse
The value of booting from a VHD in Windows 7
What to do with network penetration test results
How to set your baseline with host integrity monitoring software
A closer look at Internet Explorer 8 security features

Endpoint and NAC Protection
Look into SIEM services to cut costs, comply with PCI DSS, HIPAA
Voice data security risks on the rise, say experts
The value of booting from a VHD in Windows 7
Thin-client technologies surge thanks to easier security, says Deloitte
A closer look at Internet Explorer 8 security features
USB drive security best practices and processes
First step in forensics: Create a bootable Windows environment CD
Protecting enterprise networks from new mobile application downloads
Four things to remember about server virtualization security concerns
College learns lessons in choosing the right NAC appliance

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
Centre for the Protection of National Infrastructure  (SearchSecurityUK.com)
Serious Organized Crime Agency  (SearchSecurityUK.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


Peter Wood EXPERT RESPONSE FROM: Peter Wood

Pose a Question
Other Security UK Categories
Meet all Security UK Experts
Become an Expert for this site
ANSWERED March 2009:
I guess using Wireshark, a freely available network tool that captures network packets and data, depends on your objective. I use packet sniffing as an "audit trail" when I'm conducting penetration tests. By recording all traffic in and out of my test laptop, I can relatively easily demonstrate what I did and how the systems under the test responded. In this instance, the packet sniffer is running on the same machine I use to run the tests.

Another use of packet sniffing may be to conduct surveillance on users to ensure they are adhering to corporate policy. Naturally, this requires their consent. To achieve this, you would need to connect to a spanning port on the relevant switch in order to see all traffic for that network segment.

Finally, it's extremely useful to use a packet sniffer to monitor a computer's activity if you believe it may have been compromised, for example with a Trojan program or virus. You could connect a PC running a packet sniffer to a hub, to which you also connect the suspect machine. You can then observe all traffic in and (more importantly, out) of the suspect device and quickly determine if something is causing it to send data out to an attacker.




Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Access Management: Authentication, Biometrics, Password Security
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2008 - 2010, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts