SEARCH

How-To Geek

How to Identify Network Abuse with Wireshark

Wireshark is the swiss army knife of network analysis tools. Whether you’re looking for peer-to-peer traffic on your network or just want to see what websites a specific IP address is accessing, Wireshark can work for you.

We’ve previously given an introduction to Wireshark. and this post builds on our previous posts. Bear in mind that you must be capturing at a location on the network where you can see enough network traffic. If you do a capture on your local workstation, you’re likely to not see the majority of traffic on the network. Wireshark can do captures from a remote location — check out our Wireshark tricks post for more information on that.

Identifying Peer-to-Peer Traffic

Wireshark’s protocol column displays the protocol type of each packet. If you’re looking at a Wireshark capture, you might see BitTorrent or other peer-to-peer traffic lurking in it.

You can see just what protocols are being used on your network from the Protocol Hierarchy tool, located under the Statistics menu.

This window shows a breakdown of network usage by protocol. From here, we can see that nearly 5% of packets on the network are BitTorrent packets. That doesn’t sound like much, but BitTorrent also uses UDP packets. The nearly 25% of packets classified as UDP Data packets are also BitTorrent traffic here.

We can view only the BitTorrent packets by right-clicking the protocol and applying it as a filter. You can do the same for other types of peer-to-peer traffic that may be present, such as Gnutella, eDonkey, or Soulseek.

Using the Apply Filter option applies the filter “bittorrent“. You can skip the right-click menu and view a protocol’s traffic by typing its name directly into the Filter box.

From the filtered traffic, we can see that the local IP address of 192.168.1.64 is using BitTorrent.

To view all the IP addresses using BitTorrent, we can select Endpoints in the Statistics menu.

Click over to the IPv4 tab and enable the “Limit to display filter” check box. You’ll see both the remote and local IP addresses associated with the BitTorrent traffic. The local IP addresses should appear at the top of the list.

If you want to see the different types of protocols Wireshark supports and their filter names, select Enabled Protocols under the Analyze menu.

You can start typing a protocol to search for it in the Enabled Protocols window.

Monitoring Website Access

Now that we know how to break traffic down by protocol, we can type “http” into the Filter box to see only HTTP traffic. With the “Enable network name resolution” option checked, we’ll see the names of the websites being accessed on the network.

Once again, we can use the Endpoints option in the Statistics menu.

Click over to the IPv4 tab and enable the “Limit to display filter” check box again. You should also ensure that the “Name resolution” check box  is enabled or you’ll only see IP addresses.

From here we, can see the websites being accessed. Advertising networks and third-party websites that host scripts used on other websites will also appear in the list.

If we want to break this down by a specific IP address to see what a single IP address is browsing, we can do that too. Use the combined filter http and ip.addr == [IP address] to see HTTP traffic associated with a specific IP address.

Open the Endpoints dialog again and you’ll see a list of websites being accessed by that specific IP address.


This is all just scratching the surface of what you can do with Wireshark. You could build much more advanced filters, or even use the Firewall ACL Rules tool from our Wireshark tricks post to easily block the types of traffic you’ll find here.

Chris Hoffman is a technology writer and all-around computer geek. He's as at home using the Linux terminal as he is digging into the Windows registry. Connect with him on Google+.

  • Published 03/12/12

Comments (9)

  1. martin

    Thanks for giving the more information about the How to Identify Network Abuse with Wireshark

  2. Tuck

    Can wireshark track the IP and show the country of someone on a chat…Like yahoo for example?
    Like sometimes you are chatting and person says they are in Australia or where ever and actually they are in Ghana LOL

  3. Rimas

    I prefer for network analyst Colasoft Capsa 7, could you please write a review about this software.

  4. Chris Hoffman

    @Tuck

    If you’re directly connected to them and can see their IP address. But you can do that with lots of other tools, too! Wireshark isn’t magic. Most of the time, when you chat with someone, you don’t know their IP address.

    @Rimas

    Looks interesting; I’ll take a look at it. Of course, the free version has to be powerful enough.

  5. robert

    Good to know about the How to Identify Network Abuse with Wireshark

  6. Joep

    I feel obligated to point out that BitTorrent is not necessarily in violation of law, and thus not by definition abuse of a network.
    Legal content is also distributed through use of BitTorrent, yesterday I downloaded a Demo of a game and the Visual Studio 11 Beta through a torrent.

  7. Jock

    Is there an OSX equivalent?

  8. Chris Hoffman

    @Joep

    BitTorrent and other p2p traffic is in violation of certain network policies because it sucks up bandwidth (think corporate or educational networks), that’s all.

    @Jock

    Wireshark also runs on OS X.

  9. Wolf

    P2P traffic can also be in violation of your ISP’s terms of agreement. My ISP allows it, but they have their bandwidth throttled down so much that if you use a P2P program you will very quickly freeze up your internet connection and have to reboot the modem.

Enter Your Email Here to Get Access for Free:

Go check your email!