Introduction

Wireshark, a packet sniffer, is introduced in the first section.. It has various complex
capabilitie. Wireshark is used in the experimentation in this article, and includes
Wireshark installation, packet capture, and protocol [Link] businesses with
on-premise IT systems will get the most out of their IT investment by using Enterprise
Cloud Computing. A Cloud for the Enterprise ensures that consumers of private
enterprises have access to a highly flexible operating network. These companies will
take advantage of some of the same operational advantages in a public cloud
computing environment.
 Statistical analysis
TCP/IP Network Stack
1. Network Boundaries:
Any time data passes a network device or leaves one logical network and enters
another, a boundary can be created. Many businesses have a number of internal
network devices that may connect virtual LANs (VLANs) or offer redundancy.
For example, my ip address is [Link] where thee ip addres defines the internet
protocol as for this the protocol is ipv4.
2. Active Nodes:
These are the nodes which are currently active in the boundary of your internet
[Link] may be more than one active nodes at same time such as ethernet and
ipv4 and tcp etc.
If the packet/data is moving then the nodes will show its address bytes etc and if not
then it will show nothing because of no tracing of packet.
3. External Sources:
While sometime there is a situation where the packet travels betwwen a self made
public protocol which is made up of two private protocols to avoid traffic and
leakage of packet set.
4. Types of traffic & protocols:
This recorded file contains a number of distinct protocols. The following are the
protocols: 1. Address Resolution Protocol
2. Hypertext Transfer Protocol
3. IGMP, TCP , UDP IGMP , NBNS
Virtual Network Computing (VNC)
In the capture file, these protocols have distinct versions as well. Web hosting, which
employs the HTTP protocol, is a good example of traffic. Terminal services that use
the SSH protocol are another example. For reference, the Protocol Hierarchy statistics
are listed below.

Capturing Packets

Test Run
Let's examine what those packets include by following one of the dialogues (also
known as network flows), selecting one of the packets and using the right mouse
button (on a mac, use the command button and click), you should see something like
this:
Color Coding: Packets will most likely be shown in green, blue, or black. Colors are
used by Wireshark to help you understand easily the different forms of traffic at a
glance. Green indicates TCP traffic, dark blue indicates DNS traffic, light blue
indicates UDP traffic, and black indicates TCP packets that have issues or are being
problematic, such as being sent out-of-order.
.
ACTIVITY NARRATIVE AND ATTACK IDENTIFICATION:

Now we'll use Wireshark to sniff for TLS/SSL transactions and browser cookies that
may be used to hijack a browser session and launch a Man in the Middle (MitM)
attack. In a MitM attack, the attacker convinces two devices to transmit all of their
packets to the attacker's device rather than directly to each other while actively
listening on them, and then forwards these packets to avoid disrupting the connection.
In this section of the lesson, I'll show you how to automate the process of ARP-Cache
poisoning to construct a MitM between a target device and a wireless router using the
Linux programme ettercap. We must first confirm that our ARP-Cache Poisoning
attack is [Link] I first launch ettercap, I go to the menu bar and pick Hosts
> Scan for Hosts. After ettercap has completed detecting hosts, I want to CTRL+click
the IP addresses of my target computer ([Link] in this case) and the router, then
select Mitm > Arp Poisoning from the menu.
I'll verify Sniff distant connections in a window that displays.
Now that I'm attempting ARP-Poisoning, I'm going to Wireshark to check if any
interesting packets are present.
The ARP Poisoning packets will alert the Router and the Target device of the false
information. Now that we've eavesdropped on the communications between the router
and the target, we can use Wireshark to look for vulnerabilities. In this situation,
Detecting sniffers and Recognizing

Sniffers are difficult to detect on a network because, as previously indicated, they

function invisibly. However, there are a few techniques for detecting the presence of a
[Link] traffic between two targets will also be recorded if the assault is effective.
If clear-text authentication packets from the victim's PC are included in the stream,
the credentials may be exposed.
A sniffer can be detected in two ways: on the host and on the [Link] a
sniffer requires the network interface to be in "read all" mode in order to function,
deactivating it allows you to quickly shut down any errant [Link] network-based
detection,an anti-sniffer software may also be employed to detect the existence of
specific signature packets.

Protection from Sniffers

While designing a robust perimeter, the first stage in network architecture should be a
defence system. There are a few approaches to make the infrastructure less sniffer-
prone. The following suggestions can help you achieve your objective to a big
[Link] diversity is a difficulty and a commercial advantage. To ensure
effective exploitation of human resources to achieve specific objectives, an increasing
number of progressive groups have recognized the need for an assessment of a diverse
workforce. The degrees with which managers understand the variety and its possible
benefits and downsides define a diverse organizational strategy for an organization.
No company would flourish without a diverse workforce in today's globalized
environment. Organizations are expected to develop methods to improve the quality
of working life.  Organizations, have but still not determined the means to make use
of diversity and to make use of it. The actual positive and unfavorable results are
determined by the attitude to variety and not by the difference itself. Finally, it takes
effort and much more effort to build a multicultural workplace. Management and
executives should not lose their attention on generating various employees because
there is no instant [Link] network interface mode, as well as other actions and
programmes on servers and network hosts, may be detected by anti-sniffing software.
Modern intrusion detection systems provide this as a standard [Link] token-based
packet security in the network, IPSec encryption can be [Link] systems are
being safeguarded. Let's have a look at a couple sniffer products to see what's out
there in the FOSS world right now. To capture and store TCP packets, Linux systems
use the tcpdump software, which is an excellent built-in sniffer. The GUI interface,
packet filtering, and viewing functions of Wireshark (Ethereal), a third-party open
source software, are well-known. Ettercap, Sniffit, and DSniff

FOSS systems have no built-in security against sniffers. The techniques described
here might be used to make a number of Linux distributions less vulnerable to sniffer
[Link] is how the attack sniifing works and identifies.
ATTACK EXPLANATION:
Wireshark is used by the attacker PC to collect traffic and check for unsolicited
Address Resolution Protocol responses. The traffic between two targets will also be
recorded if the assault is effective. If clear-text authentication packets from the
victim's PC are included in the stream, the credentials may be exposed.
Wireshark Overview and Man in the Middle Attacks
Wireshark is a network packet sniffer that lets you capture packets and data in real
time via a configurable GUI with a number of interfaces. It's also a fantastic tool for
analysing, sorting, and exporting data to other applications.
Display filters are a powerful tool that may help you discover the information you
need fast. The Wireshark handbook has the entire syntax for these expressions, but
we'll go through a few simple ones to get you started.

dns == [Link] && [Link] == [Link]

This filter displays all recorded packets that utilise the DNS protocol that arrive from
or go to the IP address [Link].
dns!= [Link] && [Link]!= [Link]

Any DNS protocol packets that do not originate from or proceed to the ip address
mentioned are shown by this filter. If you're looking for faults or interesting packets
elsewhere, this might be a good way to exclude your device from the results.
http && [Link]==17 && [Link]==[Link]
he attacker sends a high volume of SYN packets to the server using spoofed IP
addresses causing the server to send a reply (SYN-ACK) and leave its ports half-open,
awaiting for a reply from a host that doesn’t [Link] we can see there are three hosts
which is currently connected and the ip address of [Link] shows a packet loss
which shows sniffed [Link] loss of packet is negotiable so as we see there is a
loss of 10+m b packet which confronts the atack on file capturing.
We can find attack by sending packet and observing a data [Link] below ss you can
observe data capturing and leakage of data which shows wifi attack.
To see the attack in computer ,task manager is used where it shows the packet attack
and sniffer which is being used for that.
We can determine if the source is known and the traffic is legitimate by combining
the aforementioned information with different traffic kinds. Finally, we may begin to
track individual streams in order to have a better understanding of specific user
behaviours.
Refrences:
 Wayne 2006,Cyber Security Practice,15
 Student Paper,Cyber Attacks,Austrailia 2006