Using wireshark to watch systems and check for signs of suspicious activity, etc.

Anyone have a good tool or workflow to analyze a full 24 hours worth of wireshark activity?

Basically trying to see if a machine has been compromised or has malware that is reporting home.

I mainly want to be able to run an IP lookup on all IPs for outbound traffic, but there can be a LOT of them and don't want to have to do it manually.

 

I haven't used wireshark in a few years and even then it was sparingly so I could be making a fool of myself.

With that said, wouldn't that kind of capability have to be built into the edge router? I've used the logs of routers to track down a PC spewing malware induced web traffic before. Since routers/switches don't broadcast to all ports like a hub how could you run wireshark on a PC on the network and analyze all network traffic if that traffic isn't being forwarded to the PC running Wireshark?

You'd have to run wireshark on each PC and then find a way to get the results from each PC forwarded to a main PC so that you could analyze the results of each PC.

Also have you tried running sysinternals tcp/ip viewer?

 

Stunna, I am just trying to see if the particular PC is sending outbound traffic, and to where.

I run Wireshark on the PC in a closed environment (or not) and see where the outbound traffic tries to go.

 

So you've got it narrowed down to one? Does it really matter where it's going or are you just using wireshark to detect if this PC is infected with a virus?

Have you tried running the usual TDSSkiller, ESET Sirefef removal tool (been personally kicking ass for me lately), combofix, MSERT, malwarebytes, and a manual scan using autoruns, and if necessary process explorer and tcp/ip viewer? I've yet to come across a machine that makes it through all of those still infected, not that it's not possible, of course.

 

Daniel, I appreciate the thoughts but as I stated, I am specifically interested in the outbound traffic and where it is headed. That's it. Not really concerned about infections, per se, but any keylogging software that is reporting back or remote access software that is trying to connect out or send out data. Mainly related to a computer that has been part of an intrusion and may be compromised.

 

Disclaimer: I don't know anything about Wireshark logs

If the logs are just ASCII text, it sounds like a few lines of shell script in a
*nix or cygwin environment should handle it pretty easily?

Roughly, something like ..
Probably the hardest part of the script would be extracting and cleaning up
the ip-addresses from the Wireshark log, and generating a clean list of "$TARGETS"
but I have rarely encountered any pattern processing problems that
grep/sed/cut couldn't solve.

Um, in case you don't know shell scripting the pseudocode for the above is:
-extract the raw lines of text from the wireshark log containing outbound ipaddrs and then save just the ip-addrs to a list of TARGETS
-for each unique target ip-addr
- count the number of times that ip-addr appears in the TARGETS list
- write to a REPORT - the unique ip-addr and the frequency of occurrence in the wireshark log
- use the 'dig' command to reverse-lookup the unique ip-addr and add its output to the REPORT

 

Enterprise switches have a feature called mirror port. When you have a port on a switch configured as a mirror all traffic on that switch will be echoed to the mirror port.

 

Wireshark has the ability to resolve names. It won't store the names in the output file but you should be able to see the names in the wireshark program if you have the feature enabled.
http://lmgtfy.com/?q=wireshark+host+resolution

 

Thanks doopstr and underdog.