Listen to this Post
Introduction:
Wireshark is a powerful network protocol analyzer often used for troubleshooting, but its capabilities extend far beyond IT diagnostics. Cybersecurity professionals—and attackers—leverage Wireshark to monitor, analyze, and exploit network traffic. This article provides essential Wireshark filters for Operational Technology (OT) and Industrial Control Systems (ICS) security, along with practical examples to detect malicious activity.
Learning Objectives:
- Learn Wireshark filters for OT/ICS network discovery and threat detection.
- Understand how attackers use Wireshark and how to defend against such techniques.
- Access free packet capture resources for hands-on practice.
You Should Know:
1. Network Discovery with Wireshark
Attackers and defenders alike use Wireshark to map networks. Key filters:
Find broadcast traffic:
“`bash.dst == ff:ff:ff:ff:ff:ff“`
- What it does: Identifies broadcast packets sent to all devices on a network.
- How to use: Apply this filter to detect reconnaissance attempts or rogue devices.
ARP responses (IP to MAC mapping):
“`bash.opcode == 2“`
- What it does: Filters ARP replies, which map IP addresses to MAC addresses.
- How to use: Detect ARP spoofing attacks by monitoring unexpected ARP replies.
DHCP Discover/Request:
“`bash.option.type == 53“`
- What it does: Captures DHCP traffic, often used in rogue DHCP server attacks.
- How to use: Identify unauthorized DHCP servers in OT environments.
2. Detecting Suspicious Activity
Wireshark can flag potential malicious behavior:
Port scanning:
“`bash.flags.syn == 1 && tcp.flags.ack == 0“`
- What it does: Filters SYN packets, a hallmark of TCP port scanning.
- How to use: Detect active scanning in critical OT networks.
Connections to uncommon ports:
“`bash.dstport < 1 || (tcp.dstport > 1024 && tcp.dstport != 502 && tcp.dstport != 44818)“`
– What it does: Highlights traffic to non-standard ports (excluding common OT ports like 502 for Modbus).
– How to use: Identify potential command-and-control (C2) traffic.
High-order port traffic:
“`bash.dstport > 1024“`
- What it does: Filters traffic to ephemeral ports, often used in malware exfiltration.
- How to use: Monitor for data leaks or covert communications.
3. General Utility Filters
Essential Wireshark commands for analysis:
Follow a TCP stream:
“`bash.stream eq “`
- What it does: Reconstructs a full conversation between two hosts.
- How to use: Investigate suspicious sessions for malicious payloads.
Filter by IP:
“`bash.addr == “`
- What it does: Isolates traffic to/from a specific IP.
- How to use: Track communications involving a compromised device.
Filter by MAC address:
“`bash.addr == “`
- What it does: Filters traffic by hardware address.
- How to use: Detect MAC spoofing or unauthorized devices.
4. Analyzing OT/ICS Protocols
Critical filters for industrial networks:
Modbus traffic:
“`bash“`
- What it does: Displays all Modbus communications.
- How to use: Detect unauthorized Modbus commands (e.g., forced coil writes).
Modbus write single coil:
“`bash.func_code == 5“`
- What it does: Filters Modbus “Write Single Coil” commands.
- How to use: Identify potential sabotage attempts in ICS environments.
DNP3 traffic:
“`bash.port == 20000 / dnp3“`
- What it does: Captures Distributed Network Protocol (DNP3) traffic.
- How to use: Monitor for unauthorized SCADA system changes.
5. Free Packet Capture Resources
Practice with real-world traffic:
What Undercode Say:
Key Takeaway 1: Wireshark is a double-edged sword—attackers use it for reconnaissance, so defenders must master it for detection.
Key Takeaway 2: OT/ICS networks require specialized filters to detect threats like unauthorized Modbus commands or port scanning.
Analysis:
Wireshark’s versatility makes it indispensable for cybersecurity professionals. By leveraging these filters, defenders can proactively identify threats in industrial networks. However, adversaries also exploit Wireshark’s capabilities, meaning continuous monitoring and anomaly detection are critical. As OT/ICS systems increasingly interconnect with IT networks, Wireshark proficiency will become a core skill for securing critical infrastructure.
Prediction:
With the rise of IoT and OT/ICS convergence, Wireshark’s role in cybersecurity will expand. Future attacks may leverage AI-driven traffic obfuscation, necessitating advanced Wireshark scripting and machine learning integrations for defense. Organizations must invest in training to stay ahead of adversarial tactics.
IT/Security Reporter URL:
Reported By: Https: – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
