Wireshark

by **tsiric17** on Sun Apr 15, 2012 5:03 am ([msg=65708]see Wireshark[/msg])

Hello fellow hackers !

I need some help and since i didnt know where else to post this im posting it here. Besides there are more experienced hackers here then any other sites i know of...

Anyway my problem is my dorms network... Someones computer cought a worm and now its spreading through the network and "killing" our download speed... The network administrator said he cant do anything but that we can use wireshark to check for suspicious traffic. The thing is i dont have a lot of experience with wireshark so could anyone explain to me how to use it to find the worm? I also have Cain and Abel and Nmap if it helps. Im preety sure my computer is not the problem because i have antivirus and i ran my backup as soon as i found out. :/

thx in advance

tsiric17 wrote:The network administrator said he cant do anything but that we can use wireshark to check for suspicious traffic

Isn't that the network administrators job? Anyway i don't knnow about the specific situation but what exaclty are you not sure about? I thought wireshark was pretty easy to figure out, just a matter of sniffing the right interface and having some idea what you're looking for, in your case, suspicious traffic.

by **tsiric17** on Tue Apr 17, 2012 7:33 am ([msg=65720]see Re: Wireshark[/msg])

Well, obviously it isnt, because he isnt doing a damn thing... :/
Anyways the whole thing is now resolved as this morning the internet was fixed ( they say it was something to do with people connecting to the network with their smartphones)

Ill try to learn a bit more about wireshark for future situations

If your using windows I would make sure your c:\ drive isn't able to be shared, and your remote registry and telnet services are disabled. Just in case the worm decides to return.

LoGiCaL__ wrote:If your using windows I would make sure your c:\ drive isn't able to be shared, and your remote registry and telnet services are disabled. Just in case the worm decides to return.

Turns out it wasnt a worm like it was originally thought. The problem was that people were connecting with their smartphones to the wireless network through a program called connectify ( i think, might be a website im not sure), which kept sending apr packets to everyone on the network, whetever we were using it or not... :/ but thx anyway

You should mention to the network admin that their should be mac address filtering on the router. Not that it would be hard to spoof. However, it should cut down the amount of users connecting with that app.