BRM wrote:
Wireshark will show you the raw packet data, and decode only a little of it -
enough to identify the general protocol, senders, etc.
So to understand the packet, you will need to understand the application layer
protocol - in this case HTTP - yourself as Wireshark won't help you there.
But yet, Wireshark, nmap, and nessus security scanner are the tools, less so
nessus as it really is more of a port scanner/security hole finder than a debug
tool for applications (it's basically an interface for nmap for those purposes).
HTH,
Ben
If finally did it again, and is doing it as I type. I captured some of
the traffic with Wireshark. Can someone tell me what to do with it
now? This is one frame of it:
Frame 4 (881 bytes on wire, 881 bytes captured)
Arrival Time: Aug 24, 2010 21:03:35.518314000
[Time delta from previous captured frame: 0.000383000 seconds]
[Time delta from previous displayed frame: 0.000383000 seconds]
[Time since reference or first frame: 0.010995000 seconds]
Frame Number: 4
Frame Length: 881 bytes
Capture Length: 881 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:http]
[Coloring Rule Name: HTTP]
[Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: ArchtekT_81:d5:d3 (00:01:53:81:d5:d3), Dst:
Motorola_aa:96:e4 (00:1d:6b:aa:96:e4)
Destination: Motorola_aa:96:e4 (00:1d:6b:aa:96:e4)
Address: Motorola_aa:96:e4 (00:1d:6b:aa:96:e4)
.... ...0 .... .... .... .... = IG bit: Individual address
(unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
Source: ArchtekT_81:d5:d3 (00:01:53:81:d5:d3)
Address: ArchtekT_81:d5:d3 (00:01:53:81:d5:d3)
.... ...0 .... .... .... .... = IG bit: Individual address
(unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 98.136.112.30
(98.136.112.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 867
Identification: 0xe5fb (58875)
Flags: 0x02 (Don't Fragment)
0.. = Reserved bit: Not Set
.1. = Don't fragment: Set
..0 = More fragments: Not Set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xbd48 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 98.136.112.30 (98.136.112.30)
Transmission Control Protocol, Src Port: 43281 (43281), Dst Port: http
(80), Seq: 0, Ack: 1, Len: 815
Source port: 43281 (43281)
Destination port: http (80)
[Stream index: 1]
Sequence number: 0 (relative sequence number)
[Next sequence number: 815 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 92
Checksum: 0x0d09 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 177975147, TSecr 3960038659
[SEQ/ACK analysis]
[Number of bytes in flight: 815]
Hypertext Transfer Protocol
GET /v1/displayImage/custom/yahoo/<screen name was here>?redirect=0
HTTP/1.1\r\n
[Expert Info (Chat/Sequence): GET
/v1/displayImage/custom/yahoo/<screen name was here>?redirect=0
HTTP/1.1\r\n]
[Message: GET /v1/displayImage/custom/yahoo/<screen name
was here>?redirect=0 HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: GET
Request URI: /v1/displayImage/custom/yahoo/<screen name was
here>?redirect=0
Request Version: HTTP/1.1
Host: rest-img.msg.yahoo.com\r\n
Connection: close\r\n
User-Agent: Mozilla/5.0 (compatible; Konqueror/4.4; Linux
2.6.30-gentoo-r8; X11; i686; en_US) KHTML/4.4.5 (like Gecko)\r\n
Accept: text/html, image/jpeg;q=0.9, image/png;q=0.9, text/*;q=0.9,
image/*;q=0.9, */*;q=0.8\r\n
Accept-Encoding: x-gzip, x-deflate, gzip, deflate\r\n
Accept-Charset: iso-8859-1, utf-8;q=0.5, *;q=0.5\r\n
Accept-Language: en-US, en\r\n
[truncated] Cookie: B=ailkv295qsqnr&b=3&s=dn;
Y=v=1&n=bt77n8119ils3&l=30b4a_rzwx/o&p=m2316qt013000000&jb=16|47|&r=eg&lg=en-US&intl=us&np=1;
T=z=b/fcMBbF1cMBqnoHCK8Lm6qNDAxBjU0NDE0MjVPMzI-&a=YAE&sk=DAAgQw54KM2VAc&ks=EAAQtPQ3LsapOyL9MIqyK3.8
\r\n
No. Time Source Destination Protocol
Info
5 0.152339 98.136.112.30 192.168.1.2
HTTP HTTP/1.1 401 Authorization Required (text/html)
I changed the screen name to protect the innocent. She is a red head
with attitude. Anyway, looking at more than one frame here, it looks
like it is trying to get info, image perhaps, for that contact but it
fails so it keeps trying. Been going at it for half hour or more so
far. It looks to me like Yahoo would eventually say "bugger off"!! LOL
I remember that Yahoo removed images and some kind of profile thingy a
while back. Could that be what it is trying to find but that no longer
exists?
Thoughts?
Dale
:-) :-)
