#What is wireshark io graphs series#
#What is wireshark io graphs mac#

At this point, we will use the Device Map to see what types of communication are common to this host.There are three different types of alerts associated with this source address. We might filter on this IP address in the Alerts list to see if all the alerts are related to scanning. Notice that there seem to be two devices involved with 192.168.2.166 being the initiator. Now let’s look at this scanning device in the Devices Map to see if it has multiple alerts like this one.So how do we evaluate this specific alert? Let’s follow the sequence… Some ICSs routinely scan all active devices to determine if they are functional and communicating. As described in the alert, this activity could be normal or it could be malicious.If the activity appears to be malicious, attempt to place it in Att&ck for ICS framework.Look for remote access to target from internet or DMZ address(es), could be RDP, VNC, SSH.Look for file transfer to/from suspect address(es) over SMB, FTP, SFTP, FTPS, SCP, HTTP, HTTPS, etc.Look for internet or DMZ sessions with the suspect address(es).Apply interesting conversations as filter.Use statistics – conversations – limit to display filter: to see what other conversations are initiated from suspect source.Note any meaningful text in message flow.These can be determined by by looking at Statistics – Protocol Hierarchy, then Statistics – Flow Graph

#What is wireshark io graphs mac#

Load pcap file into Wireshark, Determine if protocol in question is identified in Wireshark, Filter traffic on IP / MAC Addresses involved in alert.

Make note of specific IP / MAC addresses involved.

Utilize data mining to determine what types of conversations the suspect device has had.

Utilize properties in Devices Map to determine if the device has multiple alerts.

Review type of alert to understand the cause for concern.

Any examples used would be scrubbed and addresses anonymized.

This initial sequence will be used for all the investigations.Īs the blog progresses, if you have an alert of concern and you are willing to provide a pcap, we can follow this process for your alert. We will follow a basic sequence to start the analysis. We will take specific Microsoft Defender for IoT alerts and try to understand what initiated the alert and if the issue is one needing further investigation or remediation or not.

#What is wireshark io graphs series#

This blog will be one in a series of blogs to discuss the above topic.