Capture and Analysis of Network Packets Using Wireshark

 

Capture and Analysis of Network Packets Using Wireshark

 

Aim

To capture network packets using Wireshark and analyze the captured packets to study communication using TCP

 

Steps

 

 

1. Install TShark

sudo apt update

sudo apt install -y tshark wireshark-common

2. Verify TShark

tshark –version

3. Test TShark

sudo tshark -D

4. Start the TCP packet capture

sudo tshark -i eth0 -w /tmp/TCP_Analysis.pcapng

5. Stop packet capture

Ctrl + C

6. Check the capture file

ls -lh /tmp/ TCPPkts.pcapng

7. Change File permissions

sudo chmod 644 /tmp/ TCPPkts.pcapng

8. Analysing the file for TCP Three way handshake, Piggybacking and Connection Termination

tshark -r /tmp/TCPPkts.pcapng -Y "tcp.stream==21"

9. Execute python script to determine Packet statistics
1. Source and Destination IP address
2. Protocols
3. Plot Time Vs packets/Sec

// Python script to analyze the pcap file

 

import subprocess

import pandas as pd

import matplotlib.pyplot as plt

from io import StringIO

 

# PCAP FILE

pcap_file = "/tmp/TCPPkts.pcapng"

 

# EXTRACT PACKET INFORMATION USING TSHARK

cmd = [

    "tshark",

    "-r", pcap_file,

    "-T", "fields",

 

    "-E", "header=y",

    "-E", "separator=,",

    "-E", "quote=d",

 

    "-e", "frame.time_epoch",

    "-e", "ip.src",

    "-e", "ip.dst",

    "-e", "frame.protocols"

]

 

result = subprocess.run(

    cmd,

    capture_output=True,

    text=True

)

 

# CHECK TSHARK ERROR

if result.returncode != 0:

 

    print("\nTShark Error:")

    print(result.stderr)

    exit()

 

# READ TSHARK OUTPUT

df = pd.read_csv(

    StringIO(result.stdout)

)

 

# Remove empty timestamp rows

df = df.dropna(

    subset=["frame.time_epoch"]

)

 

# Convert timestamp

df["frame.time_epoch"] = pd.to_numeric(

    df["frame.time_epoch"],

    errors="coerce"

)

 

# Remove invalid timestamps

df = df.dropna(

    subset=["frame.time_epoch"]

)

 

# IP ADDRESS STATISTICS

print("\n")

print("IP ADDRESS STATISTICS")

print("\nSOURCE IP ADDRESSES")

print(

    df["ip.src"]

    .dropna()

    .value_counts()

)

 

print("\nDESTINATION IP ADDRESSES")

 

print(

    df["ip.dst"]

    .dropna()

    .value_counts()

)

 

# PROTOCOL STATISTICS

print("\n")

print("PROTOCOL STATISTICS")

 

protocols = (

    df["frame.protocols"]

    .dropna()

    .str.split(":")

    .explode()

    .value_counts()

)

print(protocols)

 

# TIME VS PACKETS / 5 SECONDS

 

# Relative time from first packet

df["relative_time"] = (

    df["frame.time_epoch"]

    - df["frame.time_epoch"].iloc[0]

)

 

# Group packets into 5-second intervals

df["time_sec"] = (

    (df["relative_time"] // 5) * 5

).astype(int)

 

# Count packets in every 5-second interval

packets_per_5sec = (

    df.groupby("time_sec")

    .size()

)

 

# PLOT

 

plt.figure(figsize=(10, 6))

 

plt.plot(

    packets_per_5sec.index,

    packets_per_5sec.values,

    marker="o"

)

 

plt.xlabel("Time (seconds)")

plt.ylabel("Packets / 5 Seconds")

 

plt.title(

    "TCP Packet Analysis: Time Vs Packets per 5 Seconds"

)

 

plt.grid(True)

plt.tight_layout()

 

opt_file = "/home/drranurekha/Time_vs_Packets.png"

 

plt.savefig(

    opt_file,

    dpi=300,

    bbox_inches="tight"

)

 

print("\nGraph saved:")

print(opt_file)