TCPdShark

shark1For an IT 566 forensics assignment, I wrote a Wireshark plugin known as TCPdShark. It is a variation of TCPdSTAT. I have tweaked it to search for network abnormalities that would reflect an intrusion or attack as well as provide a baseline reading for network administrators that want to be able to quickly and painlessly analyse key protocols and their statistics.

To install this plugin, drop the LUA file in C:\Program Files\Wireshark\plugins\1.8.6\

I have not tested the script with any other platform or architecture. Please let me know if it does or does not work for you.

shar2

Features:

  • Specifically tuned for offline analysis.
  • Analyzes entire capture and specifically looks for abnormalities with SSH, IRC, TELNET, HTTP, ARP, FTP, ICMP, SMTP.
  • Highly configurable and customizable.
  • Programmed in LUA.
  • Dialogue Boxes for tweaking default thresholds on a protocol basis at start up.

Current version: 1.0.0
Current Version: 1.1.0
Edit: As of 29 Aug 2014 TCPdShark is now at version 1.1.0 and has had some bug fixes implemented thanks to the good work of Grant and Team!

Script can be downloaded Here.

6 Comments

  1. Grant Peterson February 4, 2014 4:04 pm  Reply

    Hey hey! My friend and I are actually in that same class, and we were wondering if we could build on top of your tool with some new functionality, etc. What do you think?

    • jules February 17, 2014 3:43 pm  Reply

      Whatever you guys wanna do. The source code is available at http://t3chkommie.com/opensource/ I don’t have much time these days to play with those scripts anymore. Apparently the IRC parser is fixed now. I wanted the script to generate IRC chats but the bug wasn’t allowing it. It is really need to get something working as a WS plugin. Very helpful stuff if you use it a lot.

  2. Grant Peterson February 19, 2014 12:08 am  Reply

    True that. I’ll let you know how the updates on the program come, and will link you up with the newest versions when we make some progress!

    • jules February 19, 2014 3:11 pm  Reply

      Sounds fun, If you want me to host your new version from t3chkommie.com just let me know.

    • jules March 31, 2014 9:46 pm  Reply

      Looks good guys! Did you enjoy LUA? Turns out, I have used it several times already in “the read world”. One of those languages that seems to be overlooked a lot and not bad to have some experience in.

Leave a comment

Your email address will not be published. Required fields are marked *