How to detect hackers using wireshark

Wireshark is a protocol analyzer which can help you to detect hackers. Security appliances uses deep packet inspection technique where protocol analysis is performed. This is the fundamental principle of wireshark.

In this article, we will understand two methods to detect hackers using wireshark.

How to detect hackers using wireshark with signature based detection

Signature based detection is a techhnique by which attacks can be detected using known patterns. One of the way suspicious traffic is detected is by looking for specific patters in a packet.

An example is smurf attack where the source IP address in the IP header is a broadcast IP address to the same network. A filter can be written in wireshark to display all packets containing broadcast IP address as the destination IP address.

Filters can be written for various known attacks and hacking attempts detected.

How to detect hackers using wireshark with anomaly based detection

Anomaly detection is the process by which normal traffic on the network is initially analyzed and any deviation from it can be suspected as abnormal or malicious traffic. This is another method by which security appliances detect malicious traffic.

To perform this with wireshark, you need to initially capture traffic on the network and understand normal traffic. Once a benchmark is identfied , any deviation from this could be a possible attack on the network. Note that this technique would not be as accurate as siganture based detections and could also lead to more false alarms.

Using the above two methods, you can detect hackers using wireshark.

Ebooks & Courses

Learn and implement the different wireshark filters used by network administrators in our Ebook Wireshark tutorials for Network administrators – Click here to check details on Amazon

Check out our course Python Scapy Network Programming and Automation Course on Udemy

The course will teach you how to use Python with scapy to create custom network tools and scripts for various purposes like network testing, protocol testing, automation and more. The course explains with source code and examples of different types of network scripts and tools.