Tactical Wireshark Kevin Cardwell

Visit to download the full and correct content document:

https://ebookmass.com/product/tactical-wireshark-kevin-cardwell/
Kevin Cardwell

Tactical Wireshark
A Deep Dive into Intrusion Analysis, Malware
Incidents, and Extraction of Forensic Evidence
Kevin Cardwell
California, CA, USA

ISBN 978-1-4842-9290-7 e-ISBN 978-1-4842-9291-4

https://doi.org/10.1007/978-1-4842-9291-4

© Kevin Cardwell 2023

This work is subject to copyright. All rights are solely and exclusively
licensed by the Publisher, whether the whole or part of the material is
concerned, specifically the rights of translation, reprinting, reuse of
illustrations, recitation, broadcasting, reproduction on microfilms or in
any other physical way, and transmission or information storage and
retrieval, electronic adaptation, computer software, or by similar or
dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks,

service marks, etc. in this publication does not imply, even in the
absence of a specific statement, that such names are exempt from the
relevant protective laws and regulations and therefore free for general
use.

The publisher, the authors, and the editors are safe to assume that the
advice and information in this book are believed to be true and accurate
at the date of publication. Neither the publisher nor the authors or the
editors give a warranty, expressed or implied, with respect to the
material contained herein or for any errors or omissions that may have
been made. The publisher remains neutral with regard to jurisdictional
claims in published maps and institutional affiliations.

This Apress imprint is published by the registered company APress

Media, LLC, part of Springer Nature.
The registered company address is: 1 New York Plaza, New York, NY
10004, U.S.A.
This book is dedicated to all of the students I have trained for more than
35 years. The joy of these classes where you learn something every class
has made for an incredible cybersecurity adventure, and I thank them for
this.
Introduction
I wrote this book so that people who want to leverage the fantastic
capabilities of Wireshark have a reference where you get the “hands-
on” tactical concepts that are not covered in most publications about
Wireshark. I wrote this from an analysis perspective based on more
than 30 years of being an analyst, training analysts and leading analysis
teams across the globe. Within this book, you will find the tips and
techniques that I have mastered and refined over those years of
extensive analysis. For the most part, the process has not changed, but
the methods and sophistication of the attackers and criminals have, and
this is why we have to continue to enhance and hone our skills.
As the title suggests, this book is broken down into three main
parts:
Intrusion Analysis
Malware Analysis
Forensics Analysis
The book does not go deep into topics or concepts that are not part
of what we use from a tactical standpoint of Wireshark. There are
plenty of references that are available for this. Wherever possible, we
do explain some areas outside of Wireshark, and this is most evident
when we talk about memory and how malware uses system calls for
connections. We start off with a review of what an actual intrusion
looks like, and then we introduce a methodology. This is a common
theme of the book; we present methodologies that are proven when it
comes to performing a systematic analysis process. Each of the areas
can be taken on its own, so if you just want to focus on malware, then
you can read that section.
Table of Contents
Chapter 1:​Customization of the Wireshark Interface
Configuring Wireshark
Column Customization
Malware
Summary
Chapter 2:​Capturing Network Traffic
Capturing Network Traffic
Prerequisites for Capturing Live Network Data
Normal Mode
Promiscuous Mode
Wireless
Working with Network Interfaces
Exploring the Network Capture Options
Filtering While Capturing
Summary
Chapter 3:​Interpreting Network Protocols
Investigating IP, the Workhorse of the Network
Analyzing ICMP and UDP
ICMP
UDP
Dissection of TCP Traffic
Transport Layer Security (TLS)
Reassembly of Packets
Interpreting Name Resolution
DNS
 Windows Name Resolution
Summary
Chapter 4:​Analysis of Network Attacks
Introducing a Hacking Methodology
Planning
Non-intrusive Target Search
Intrusive Target Search
Examination of Reconnaissance Network Traffic Artifacts
Leveraging the Statistical Properties of the Capture File
Identifying SMB-Based Attacks
Uncovering HTTP/​HTTPS-Based Attack Traffic
XSS
SQL Injection
HTTPS
Set the Environment Variable
Configure Wireshark
Summary
Chapter 5:​Effective Network Traffic Filtering
Identifying Filter Components
Investigating the Conversations
Extracting the Packet Data
Building Filter Expressions
Decrypting HTTPS Traffic
Kerberos Authentication
Summary
Chapter 6:​Advanced Features of Wireshark
 Working with Cryptographic Information in a Packet
Exploring the Protocol Dissectors of Wireshark
Viewing Logged Anomalies in Wireshark
Capturing Traffic from Remote Computers
Command-Line Tool TShark
Creating Firewall ACL Rules
Summary
Chapter 7:​Scripting and Interacting with Wireshark
Lua Scripting
Interacting with Pandas
Leveraging PyShark
Summary
Chapter 8:​Basic Malware Traffic Analysis
Customization of the Interface for Malware Analysis
Extracting the Files
Recognizing URL/​Domains of an Infected Site
Determining the Connections As Part of the Infected Machine
Scavenging the Infected Machine Meta Data
Exporting the Data Objects
Summary
Chapter 9:​Analyzing Encoding, Obfuscated, and ICS Malware
Traffic
Encoding
Investigation of NJRat
Analysis of WannaCry
Exploring CryptoLocker and CryptoWall
 Dissecting TRITON
Examining Trickbot
Understanding Exploit Kits
Establish Contact
Redirect
Exploit
Infect
Summary
Chapter 10:​Dynamic Malware Network Activities
Dynamic Analysis and the File System
Setting Up Network and Service Simulation
Monitoring Malware Communications and Connections at
Runtime and Beyond
Detecting Network Evasion Attempts
Investigating Cobalt Strike Beacons
Exploring C2 Backdoor Methods
Identifying Domain Generation Algorithms
Summary
Chapter 11:​Extractions of Forensics Data with Wireshark
Interception of Telephony Data
Discovering DOS/​DDoS
Analysis of HTTP/​HTTPS Tunneling over DNS
Carving Files from Network Data
Summary
Chapter 12:​Network Traffic Forensics
Chain of Custody
 Isolation of Conversations
Detection of Spoofing, Port Scanning, and SSH Attacks
Spoofing
Port Scanning
SSH
Reconstruction of Timeline Network Attack Data
Extracting Compromise Data
Summary
Chapter 13:​Conclusion
Intrusion Analysis
Malware Analysis
Forensics
Summary
Index
About the Author
Kevin Cardwell
is an instructor, curriculum developer,
and technical editor and author of
computer forensics and hacking courses.
He is the author of the EC Council
Certified Penetration Testing
Professional, Ethical Hacking Core Skills,
Advanced Penetration Testing, and
ICS/SCADA Security courses. He has
presented at the Black Hat USA, Hacker
Halted, ISSA, and TakeDownCon
conferences as well as many others. He
has chaired the Cybercrime and
Cyberdefense Summit in Oman and was
Executive Chairman of the Oil and Gas
Cyberdefense Summit. He is the author
of Defense and Deception: Confuse and
Frustrate the Hackers, Building Virtual
Pentesting Labs for Advanced Penetration Testing, 1st and 2nd editions,
and Backtrack: Testing Wireless Network Security. He holds a BS in
Computer Science from National University in California and an MS in
Software Engineering from Southern Methodist University (SMU) in
Texas.
About the Technical Reviewer
Shyam Sundar Ramaswami
is a Senior Staff Cyber Security Architect
at GE Healthcare, and his areas of work
include security research, healthcare
forensics, offensive security, and
defensive security for health-care
products. Shyam is a two-time TEDx
speaker, co-author of the book titled It’s
Your Digital Life, and a teacher of
cybersecurity. Shyam has delivered talks
in top-notch international cybersecurity
conferences like Black Hat, Qubit,
Nullcon, Deepsec, and Hack fest. Shyam
has delivered 100+ bootcamps on
malware and memory forensics across
the globe. Shyam runs a mentoring
program called “Being Robin” where he
mentors students all over the globe on
cybersecurity. Interviews with him have been published on leading
websites like ZDNet and CISO MAG.
© The Author(s), under exclusive license to APress Media, LLC, part of Springer
Nature 2023
K. Cardwell, Tactical Wireshark
https://doi.org/10.1007/978-1-4842-9291-4_1

1. Customization of the Wireshark

Interface
Kevin Cardwell1
(1) California, CA, USA

While it might not seem like a big deal, the fact is the customization of
the interface is very important in the creation of an effective analysis
plan. The Wireshark interface by default will display the following
columns of information:
Nos. – For the number identification of the packet within the display
window.
Time – The time the packet was captured; this is one of the columns
we will want to perform some changes to.
Source – The source of the generated packet; this can be in the form
of a layer two MAC address or a layer three IP address.
Destination – The destination of the generated packet; this too can
be in the form of a layer two MAC address or a layer three IP address.
Protocol – The protocol that the Wireshark tool has determined is in
the packet.
Length – The length of the data that is contained within the packet.
Info – Where additional information can be displayed about the
packet that has been captured.
In this chapter, we will review different methods of how to
customize the columns of Wireshark to assist our analysis with special
tasks. We will review a customization that can be used to assist with
malware analysis.
Configuring Wireshark
An example of the default Wireshark display configuration is shown in
Figure 1-1.

Figure 1-1 The Wireshark default display configuration

The figure reflects the default columns and the information that is
reflected. As a reference, the Protocol is Modbus.
If you are not familiar with the Modbus protocol, it was originally
created by the company Modicon in 1979. They published the protocol
as a method of communication with their Programmable Logic
Controllers or PLC. Modbus has become a popular communication
protocol and is now a commonly available means of connecting
industrial electronic devices. Modbus is popular in industrial
environments because it is openly published and royalty-free. The
company Modicon is known as Schneider Electric today. As you
continue to review the packet capture, you can see in the “Info” section
additional information about the captured packet. As the information
indicates, the packet capture is that of a Transaction Query, the number
of the Query is 209, the Unit is 1, and the Query is of type 3, which
means it is a reading of the Holding Registers.
We will not cover any more details here of this packet that has been
captured; however, as the book progresses, you will get much more
data on this and many other types of protocols.
As we stated at the beginning of this chapter, we want the
Wireshark interface to be configured so we can get the best results
when we process our data capture files, and while the default settings
are okay, they are not providing us the best opportunity to get the most
from the Wireshark tool.
The first thing we want to do is to clean up the current columns on
the Wireshark tool. When we start thinking about the process and
concept for analysis, we need to have the port information of our
communications, and with the current settings, we do not have this. We
can look for it, but it is much more efficient to have the port information
easily at our disposal. When you think of a port, a good analogy is that
of a door, so when we have a port open on a machine, it is equivalent to
an open door, and since it is open, then there can be connections to it.
This is what we want to focus on when we are reviewing a capture file,
because everything starts with a connection. Once the connection is
made, then the data will flow, especially when we discuss the
communication protocol Transmission Control Protocol (TCP) later in
the book.
So now that we have a little bit of an idea on the ports and the
concept of connections, let’s see how to make the customizations and
changes.
The main Wireshark settings when it comes to the display options
are accessed via the main top bar menu; we access the Preferences
settings by clicking on Edit ➤ Preferences. An example of this is
shown in Figure 1-2.
Figure 1-2 The Wireshark Preferences settings
As shown in the image, we do have a variety of settings that we can
select to change the way our captured data is displayed. Having said
that, for our purposes here, we will just focus on the UTC settings,
which is our representation of the GMT zone. Since we have more than
one setting available, we will use the UTC Time of Day. Additionally, we
will change the setting from Automatic to Seconds. An example of the
format changes is shown in Figure 1-3.

Figure 1-3 Time format changes

Now that we have made the settings changes, we can refer to what
the capture file looks like. An example of the time field before the
settings and one with the settings is shown next.
 For most people, including your author, it is preferred to have the
normal time format and not the default selection of number of seconds
ticked off when captured.

Column Customization
We next want to review and make some changes to our columns; this
will assist us when we are performing different types of capture file
analysis tasks. We return to our Columns settings located in the
Preferences menu and review the columns that are displayed by
default. It is true that the columns that are displayed are a matter of
personal preference; however, there are some that are displayed that
are in many cases rarely referenced. Since our User Interface does have
some limitations, we want to get the most from our displayed data. The
columns that we can delete for our first analysis profile are the
following:
1. No

2. Length

These columns are not commonly used, so it is a good idea to

remove them. Another column that you might want to remove when
doing malware analysis is the Protocol, while it is good to see the
protocol, we can determine this by more than one method, so it is a
matter of personal preference if we leave this displayed.
Once we have removed these columns, our Wireshark User Interface
will reflect that shown in Figure 1-4.
Figure 1-4 Custom columns
As reflected in Figure 1-4, we now have a more streamlined display
for our interface. We now want to add some additional columns to
discover information we commonly use in our analysis.
We add columns via the same menu selections from before and
access the settings within the Edit ➤ Preferences ➤ Columns path.
Once we are there, we need to click on the “+” sign to add a new
column. An example of this is shown in Figure 1-5.

Figure 1-5 Adding columns

Once we have added the new column, we want to customize it, we

do this by double-clicking the name, and this will highlight the name in
blue so it can be edited directly. For the first custom column, we will use
the Source Port as the name, so enter this in the Name field. An
example of this is shown in Figure 1-6.
Figure 1-6 The source port column
Any time we create a custom setting, it is always good to put as
much amplifying information as possible. We do this in the Type field.
When you double-click on the Type field, a listing of the different type
options will be displayed; an example of this is shown in Figure 1-7.
Figure 1-7 Column type options
For our Source Port column, we want to select the Src port
(unresolved). An example of this is shown in Figure 1-8.
Figure 1-8 Src port unresolved setting
The source port is one of those important items that we want to be
able to see in a relatively quick manner. We need this when we are
reviewing network communication sequences between machines. As a
refresher, network communication is usually from a client to a server;
this connection from the client is usually at a port >1023, so by
displaying the source port, it allows a quick review of the method of
communication that is reflected in the capture file. When we see a port
that is <1023 to another port that is <1023, this could be suspicious.
We say “could” because unfortunately, over time the normal
communications procedures of the network protocols are not as
structured as when we started. While it is normally a fact that the client
connection comes from a port >1023, it is not always guaranteed. These
ports >1023 are referred to as ephemeral ports. This means the ports
are considered transitory in nature, because a client should make the
connection, receive the required data, and then disconnect, and this is a
temporary sequence, hence the name.
The next column we want to add to the display is that of the
destination port; the process is the same as before; we click on the “+”
and then double-click on the name and enter the name of Dest Port.
Then as before, we click in the drop-down of the Type field and select
Destination Port (unresolved). You should now have two custom
ports that you have added. Great job! A port is resolved if the tool
recognizes the service running on the port. An example of our two
ports is shown in Figure 1-9.

Figure 1-9 Src and Dest port columns

We now want to get the display order set with our two new
columns. We can achieve this very easily by dragging the columns into
the order that we prefer. A good location for the Source Port is right
after the Source Address, so we can drag this to that location. Now, we
want to do the same for the Destination Port and place it right after the
Destination Address. An example of these changes is shown in Figure 1-
10.

Figure 1-10 Setting the order of the display columns

You might find it a little tricky to get the column to move, so look for
the red circle that is displayed to change and you should be able to drop
the column there.
After adding the source and destination port columns, click the
“OK” button to apply the changes. These new columns are
automatically aligned to the right, so right-click on each column header
to align them to the left so they match the other columns. An example of
this is shown in Figure 1-11.

Figure 1-11 The list of selected columns

Once you have finished this, then the display should reflect that as
shown in Figure 1-12.

Figure 1-12 Wireshark custom column display

 We can now quickly determine the source and destination port. This
allows us to identify a potential service that could be targeted. We will
look at an example of this now. A common method of attack is to look
for a service and then attempt to gain access once a service is
discovered that could provide us access, so with our new display that
we have just customized, we can see how easy it is to identify when a
service is getting either attacked or a lot of attention. The first service
we will look at here is the File Transfer Protocol, otherwise known as
FTP. Now, many of you reading this might be saying, “FTP. It is old!”
While this is true and an argument could be made for this, it is just
being used as an example here and in many environments is still used
today, especially in Industrial Control Systems (ICS) enterprise
networks. As a refresher, the FTP uses two ports: one for
communication and one for data. With our now custom display, we
should be able to identify this, which will also allow us to demonstrate
the analysis and determination as to the mode of FTP. But before we do
this, we need to have a good understanding of FTP. So what exactly is it?
A good source and probably one of the best ones is that of the Request
for Comments (RFC) that have been released as a recommended
standard for FTP. We refer to this as “recommended” because there is
no requirement that you have to follow the RFC, and unfortunately,
many vendors do not, but that is a topic outside of this book. Now we
could refer to the Internet Engineering Task Force at
https://ietf.org, which is shown in Figure 1-13.

Figure 1-13 Internet Engineering Task Force

As the image shows, we have the Internet Standards menu option,

and within this, we have the RFCs. An example of when the menu item
is selected is shown in Figure 1-14.

Figure 1-14 Request for Comments

The green box in Figure 1-14 is the main thing about the RFC; these
are the notes and specification for the Internet! So we must be familiar
with them if we are going to work in IT. These are documents that are in
a text format and not the best structure to read, so it does take some
time to get used to them. An example of an RFC is shown in Figure 1-15.
Figure 1-15 Example of an RFC
Figure 1-15 reflects the RFC 1918, which is the standards document
that identifies the private addressing for IP addresses that should not
be routed. These are the following addresses:
1. 10.0.0.0 (10/8)

2. 172.16-172.31 (172.16/12)

3. 192.168 (192.168/16)
 We will refer to the first block as “24-bit block”, the second as“20-
bit block”, and to the third as “16-bit” block. Note that (in pre-
CIDR notation) the first block is nothing but a single class A
network number, while the second block is a set of 16 contiguous
class B network numbers, and third block is a set of 256
contiguous class C network numbers.
—RFC 1918

The power of the RFC is anytime someone wants to research or

understand a communication protocol, the first reference is that of the
RFC. Having said that, for some, they can be a challenge to read, so
there are Internet sites that can assist with that. Even the IETF has a set
of tools that can assist us with the interpretation of an RFC; the site can
be found at https://tools.ietf.org. An example of this is shown
in Figure 1-16.

Figure 1-16 The IETF tools

 We will take a brief moment to explain some of the components of
an RFC. There should be a header related to the RFC; an example of this
is shown in Figure 1-17.

Figure 1-17 RFC header

At the top left, this header states “Internet Engineering Task Force
(IETF)”. That indicates that this is a product of the IETF; although it’s
not widely known, there are other ways to publish an RFC that don’t
require IETF consensus; for example, the Independent Submission
Stream allows RFC publication for some documents that are outside the
official IETF/IAB/IRTF process but are relevant to the Internet
community and achieve reasonable levels of technical and editorial
quality.
Now that we have an understanding of protocols that we can
research. We have a better way that we can research this information as
we are conducting our analysis.
We will now revisit our FTP; furthermore, as has been stated in this
chapter, the port number is an important component for doing our
analysis. The FTP has two main ports that are used; the first is that of
the Control and Communication, and this port is assigned to port 21.
The FTP is defined in RFC 959; an example of the RFC is shown in
Figure 1-18.
Figure 1-18 FTP RFC
As the figure shows, the FTP RFC has a date of 1985, so this does
verify that it is an older protocol. The section we want to review here is
the Data Transfer Functions, because it states that it defines the modes.
Once you select this, you will see the additional information on how the
FTP works. This is beyond the scope here, but you do have the
information if you want to pursue the topic further.
In addition to port 21, we also have a data port used with FTP. That
port is traditionally 20 for active FTP and >1023 selectable for passive
FTP. Again, these are things that as analysts you need to be aware of
when you are reviewing a capture file. In fact, an understanding of the
challenges with respect to filtering of passive vs. active FTP is an
important concept as well. A synopsis of this is as follows:
– Active Mode – The client issues a PORT command to the server
signaling that the client will “actively” provide an IP and port number
to open the Data Connection back to the client.
 – Passive Mode – The client issues a PASV command to indicate that
the client will wait “passively” for the server to supply an IP and port
number, after which the client will create a Data Connection to the
server.
As you can see, this or any other protocol for that matter takes time
to understand, and it is worth investing that time so you can better
perform your analysis.

Malware
When we investigate malware, the Wireshark columns that are
displayed by default are not the best to use when it comes to our task of
malware analysis, so thus far, we have customized some of the columns
so they can provide us with a more efficient analysis capability. Now
that we have done this, we need to add additional columns to assist us
with our analysis tasks. It is important to understand that we can and
often will customize our user interface in different ways to assist us
with our analysis of capture files. We will now look specifically at an
example of this for when we configure our user interface to maximize
our efficiency for malware analysis.
When we customize our interface, we want to plan for this and focus
on what exactly are the characteristics that we are wanting to review.
With our example of malware, one of the main things we want to track
for our analysis is the web traffic and communication sequences. This is
because malware often involves web traffic. This is due to the desire to
“blend” into the network communication traffic and appear to be
normal traffic on the network. We can also see the communication
channel for command and control (C2) that is many times disguised in
web traffic. Wireshark’s default column configuration is not ideal when
investigating such malware-based infection traffic. However, Wireshark
can be customized to provide a better view of the activity.
Earlier we customized the time reference, and we customized our
interface in such a way that it is more streamlined and can assist us
with being more efficient with our analysis and that is the goal.
Currently, we have the following columns we have customized for
our interface:
1. Time (UTC)

2. Source IP address

3. Source port

4. Destination IP address

5. Destination port

6. Info

This is a good start, and you can use it as a foundation for the
different types of analysis tasks you will perform. For our malware
analysis, we want to add additional information by adding more
columns; an example of the additional columns is shown here:
1. HTTP host

2. HTTPS server

Wireshark allows us to add custom columns based on almost any

value found in the frame details window. This is how we add domain
names used in HTTP and HTTPS traffic to our Wireshark column
display. We can quickly identify the domains in a capture file by
entering a filter. For our example here, we want to set the filter on
http.request. An example of this is shown in Figure 1-19.

Figure 1-19 The http.request filter

 Once we have filtered out the http.request data, then we go to the
middle window, and we expand the frame so we can review additional
information. An example of this is shown in Figure 1-20.

Figure 1-20 Additional http.request data

By expanding the http.request data, we can drill down deeper into

the contents of the packet to better ascertain what is or is not taking
place. One of the fields that you can discover within the data from the
packet is the host field data; this is shown in Figure 1-21.

Figure 1-21 HTTP request fields

Now, from here, we can add this data type to our user interface as a
column! All we have to do is right-click on the host data and then select
Apply as Column. An example of this is shown in Figure 1-22.
Figure 1-22 Apply as Column setting
Once the column has been selected and applied, this will add the
information to our interface. An example of the resultant output is
shown in Figure 1-23.

Figure 1-23 The host data

 As the output shows, we now have the host names within the
capture file, and these are very important for us as well when we are
doing our analysis.
As you are reading this, you might be saying that this is all well and
good, but the majority of the traffic we encounter in our analysis is
going to be using the HTTPS and that is going to make it more difficult,
and you are correct with this assumption! But as with anything when it
comes to our analysis, there will be data areas that we can and will
need to extract regardless of if it is encrypted or not. To see this HTTPS
communications, we will enter a filter of tls.handshake.type == 1. An
example of the results of this is shown in Figure 1-24.

Figure 1-24 HTTPS communication

We need to do one more step to extract the domains from this

traffic, and that involves expansion of the data within the frame located
in the middle window. To access this information, we need to expand
the frame located in the middle window for the Transport Layer
Security (TLS). Once you have expanded this, then you want to locate
the record information. An example of this location is shown in Figure
1-25.
Figure 1-25 Expanded TLS data frame
We see that we have the Client Hello; this will provide us additional
information about the connection sequence, but first, we need to
expand it; once we have expanded it, the information displayed is
shown in Figure 1-26.

Figure 1-26 TLS Record data

The next field we want to investigate and focus on is that of the

Extension server_name. We need to expand it so we can view the data
contained within; an example of this once expanded and the data is
shown in Figure 1-27.
Figure 1-27 The TLS server_name extension
Finally, located within the data section for the server_name is a field
that starts with server_name. An example of this is shown in Figure 1-
28.
Figure 1-28 Extraction of the server name in TLS connection
Now that we have the information selected, we want to right-click it
and apply as a column. The result from this is shown in Figure 1-29.

Figure 1-29 Addition of the Server Name as a column

Now, we have the domain names located within the capture file
even when the communication protocol is using HTTPS!
Since we now have both the HTTP and HTTPS domains extracted
and showing in our user interface, this will make us even more efficient
when it comes to our analysis.
 The next thing we want to do is filter on two of our data items at the
same time with a more robust filter; we can achieve this by entering the
following filter:
http.request or tls.handshake.type == 1
By using the Boolean expression of an “or”, we are selecting packets
that contain either our http.request or our tls.handshake.type set. This
is another great feature of Wireshark and the filtering capability. We
can combine different data fields to extract a variety of information and
data from our capture files. An example of the results when this
combination filter is applied is shown in Figure 1-30.

Figure 1-30 Extraction of TLS handshake data in an http.request

As we have seen throughout this first chapter, the ability to

customize our interface can help us become more efficient with our
analysis capabilities.

Summary
In this chapter, we have explored the method of customizing our
Wireshark user interface. You have learned that the default display
columns of Wireshark are not the best for conducting our analysis, so it
is best to customize these to assist us in our investigations; moreover,
this makes us much more efficient when it comes to performing
analysis of a capture file.
We showed the method of first removing the columns and then
adding the columns and customizing them as required for our analysis.
By doing this, we were able to extract pertinent information that is
often used when we are performing our analysis tasks. We included in
this section the ability to extract common artifacts and characteristics
of malware analysis. This included the common types of web traffic that
are used by the modern malware threat. We extracted the host name
from the capture file as well as the domain name. We did this for both
the HTTP and the HTTPS encrypted packet communication sequences,
which allows us to analyze encrypted or in the clear communications.
Furthermore, we applied this extracted frame data as a column and
analyzed the results from this. We have now set the user interface for
robust analysis, and this should make you a more efficient capture file
analyst using the Wireshark tool.
In the next chapter, you will set up a packet capture within the
Wireshark tool and learn the different capture options and how to filter
the capture data that is captured!
© The Author(s), under exclusive license to APress Media, LLC, part of Springer
Nature 2023
K. Cardwell, Tactical Wireshark
https://doi.org/10.1007/978-1-4842-9291-4_2

2. Capturing Network Traffic

Kevin Cardwell1
(1) California, CA, USA

In this chapter, we will review the process of capturing the network and
how we use the different features of the physical or virtual network
card and switch to obtain this information and then it is displayed.

Capturing Network Traffic

One of the first things we need to do when it comes to capturing our
network traffic is establish how we want to capture the traffic. The
network traffic that we capture is dependent on the type of network
card we are wanting to capture on.
Before we get to this, let us discuss what exactly needs to take place
to be able to capture our network traffic; to do this, we have to explore
a bit of the network architecture of our network card; moreover, we
need to have an understanding of how a network card operates. The
best way to understand this is to look at the different modes of a
network card. One caveat here, we are first talking about an IEEE
(Institute of Electrical and Electronics Engineers) 802.3 standard,
which is the Ethernet standard. We will briefly discuss wireless and
how it works but will not go into as much detail as we do with the
Ethernet protocol.
The network interface card or NIC as it is known is what connects
our machine or device to the Ethernet network; it does this by
maintaining an address that represents the Layer Two of the network
stack and is identified by a MAC (Media Access Control) address. For a
better understanding of the MAC address, we will refer to Figure 2-1.

Figure 2-1 The MAC address of the network interface card (NIC)
As the figure shows, we have the MAC address that is representing
the actual physical address of the NIC. This is a unique identifier
assigned for use as a network address in communications within a
network segment. Six groups of two hexadecimal digits, separated by
hyphens, colons. This address is represented with 48 bits; the first 24
bits are representing the organization. The addresses are often referred
to as the burned-in address. This address can be stored in hardware, as
an example, the Read Only Memory (ROM) or in firmware of the device
itself. The first 24 bits for the organization are referred to as the
organizationally unique identifier (OUI). An example of the structure of
the MAC address is shown in Figure 2-2.

Figure 2-2 The structure of the MAC address

Now that we have briefly explored the MAC address, it is important

to understand that the MAC address is used in our 802.3 specification
to uniquely identify the node on the network and allows the frames to
be marked for specific hosts. Another way to refer to this is the data is
delivered to the MAC address. This means that while an IP address is an
identifier, the actual delivery of the data needs the MAC address to be
delivered to its destination.
While we refer to these MAC addresses as physical addresses, they
can and often are changed using different utilities and software;
furthermore, manipulation of the MAC address is something that a
hacker will do to place themselves in the middle of the conversation;
this is referred to as the man-in-the-middle attack. Once the MAC
address has been “spoofed,” all data will pass through that address. One
of the main reasons for attacking at this “layer” is because the result is
all network traffic above this (3–7) is compromised once the attack is
successful at Layer Two!

Prerequisites for Capturing Live Network Data

Now that we have explored the MAC address, we now want to turn our
attention to the requirements for capturing the live network traffic. We
do this by exploring our modes deeper. As we have stated, we have our
NIC with the address, so how it functions is our next topic. The first
thing the NIC will do is read and interpret the MAC address, and if the
MAC address is the address of the NIC, then the frame will be passed up
the network stacks to the next layers, and if it is a Broadcast frame, the
process will be the same, but what about when the address is not the
address of the NIC and is not Broadcast? What happens? As you may
imagine, the NIC sees that it is not destined for it and not Broadcast, so
the frame is dropped.
So how exactly does an NIC work? A definition of this from
https://techterms.com is shown in Figure 2-3.

Figure 2-3 TechTerms.​c om definition of NIC

As it stands today, the NIC is thought of more as a physical network

card that is used in desktop or server computers and is a separate
entity all on its own where in most other computers, for example, a
laptop, the card is built into the motherboard of the computer.
Additionally, we have many computers today that do not have an
Ethernet port, and for those, we either use wireless or a form of a USB
adapter. An example of an NIC is shown in Figure 2-4.

Figure 2-4 A network interface card (Image by Michael Schwarzenberger on

http://pixabay.com)
Now that we have discussed our NIC, let us now return to the modes
of the card. Again, this is more critical when it comes to wireless, but an
understanding of the modes of the network card is also important with
our “wired” connection because we have to have the network card in
the correct mode to “sniff” the network traffic. The first mode we will
discuss here is normal.

Normal Mode
When a network interface card is in the normal mode, this means that
the network card is connected to the network, and it will accept only
the packets that are either the MAC address of its card or those packets
that have a destination of the Broadcast MAC address
(FF:FF:FF:FF:FF:FF); furthermore, when an NIC is in normal mode, any
frame that it receives that does not meet these two conditions is
dropped and does not go any further than the NIC device. An example
of a network card in normal mode and an example of the methods to
determine this are shown in Figure 2-5.

Figure 2-5 Detection of network cards mode

The hexadecimal value located in the Flags file is a value of 0x1003,
and this value is what we use to determine that the device is not in
promiscuous mode; then we have the information also available with
the ifconfig command.
In our next example, here shown in Figure 2-6, we have a network
interface card that is running in promiscuous mode.

Figure 2-6 Detection of a network card in promiscuous mode

As we see reflected here, we now have the card in promiscuous

mode.
Another random document with
no related content on Scribd:
 BOOK II
ESSAYS IN PRACTICAL EDUCATION
 CHAPTER I

THE PHILOSOPHER AT HOME

“He has such a temper, ma’am!”
And there, hot, flurried, and, generally at her wits’ end, stood the
poor nurse at the door of her mistress’s room. The terrific bellowing
which filled the house was enough to account for the maid’s distress.
Mrs. Belmont looked worried. She went up wearily to what she well
knew was a weary task. A quarter of an hour ago life had looked
very bright—the sun shining, sparrows chirping, lilac and laburnum
making a gay show in the suburban gardens about; she thought of
her three nestlings in the nursery, and her heart was like a singing-
bird giving out chirps of thanks and praise. But that was all changed.
The outside world was as bright as ever, but she was under a cloud.
She knew too well how those screams from the nursery would spoil
her day.
There the boy lay, beating the ground with fists and feet; emitting
one prodigious roar after another, features convulsed, eyes
protruding, in the unrestrained rage of a wild creature, so
transfigured by passion that even his mother doubted if the noble
countenance and lovely smile of her son had any existence beyond
her fond imagination. He eyed his mother askance through his
tumbled, yellow hair, but her presence seemed only to aggravate the
demon in possession. The screams were more violent; the beating of
the ground more than ever like a maniac’s rage.
“Get up, Guy.”
Renewed screams; more violent action of the limbs!
“Did you hear me, Guy?” in tones of enforced calmness.
 The uproar subsided a little, but when Mrs. Belmont laid her hand
on his shoulder to raise him, the boy sprang to his feet, ran into her,
head-foremost, like a young bull, kicked her, beat her with his fists,
tore her dress with his teeth, and would no doubt have ended by
overthrowing his delicate mother, but that Mr. Belmont, no longer
able to endure the disturbance, came up in time to disengage the
raging child and carry him off to his mother’s room. Once in, the key
was turned upon him, and Guy was left to “subside at his leisure,”
said his father.
Breakfast was not a cheerful meal, either upstairs or down. Nurse
was put out; snapped up little Flo, shook baby for being tiresome,
until she had them both in tears. In the dining-room, Mr. Belmont
read the Times with a frown which last night’s debate did not
warrant; sharp words were at his tongue’s end, but, in turning the
paper, he caught sight of his wife’s pale face and untasted breakfast.
He said nothing, but she knew and suffered under his thoughts fully
as much as if they had been uttered. Meantime, two closed doors
and the wide space between the rooms hardly served to dull the ear-
torturing sounds that came from the prisoner.
All at once there was a lull, a sudden and complete cessation of
sound. Was the child in a fit?
“Excuse me a minute, Edward;” and Mrs. Belmont flew upstairs,
followed shortly by her husband. What was her surprise to see Guy
with composed features contemplating himself in the glass! He held
in his hand a proof of his own photograph which had just come from
the photographer’s. The boy had been greatly interested in the
process; and here was the picture arrived, and Guy was solemnly
comparing it with that image of himself which the looking-glass
presented.
Nothing more was said on the subject; Mr. Belmont went to the
City, and his wife went about her household affairs with a lighter
heart than she had expected to carry that day. Guy was released,
and allowed to return to the nursery for his breakfast, which his
mother found him eating in much content and with the sweetest face
in the world; no more trace of passion than a June day bears when
the sun comes out after a thunderstorm. Guy was, indeed, delicious;
attentive and obedient to Harriet, full of charming play to amuse the
two little ones, and very docile and sweet with his mother, saying
from time to time the quaintest things. You would have thought he
had been trying to make up for the morning’s fracas, had he not
looked quite unconscious of wrong-doing.
This sort of thing had gone on since the child’s infancy. Now, a
frantic outburst of passion, to be so instantly followed by a sweet
April-day face and a sunshiny temper that the resolutions his parents
made about punishing or endeavouring to reform him passed away
like hoar-frost before the child’s genial mood.
A sunshiny day followed this stormy morning; the next day passed
in peace and gladness, but, the next, some hair astray, some
crumpled rose-leaf under him, brought on another of Guy’s furious
outbursts. Once again the same dreary routine was gone through;
and, once again, the tempestuous morning was forgotten in the
sunshine of the child’s day.
Not by the father, though: at last, Mr. Belmont was roused to give
his full attention to the mischief which had been going on under his
eyes for nearly the five years of Guy’s short life. It dawned upon him
—other people had seen it for years—that his wife’s nervous
headaches and general want of tone might well be due to this
constantly recurring distress. He was a man of reading and
intelligence, in touch with the scientific thought of the day, and
especially interested in what may be called the physical basis of
character,—the interaction which is ever taking place between the
material brain and the immaterial thought and feeling of which it is
the organ. He had even made little observations and experiments,
declared to be valuable by his friend and ally, Dr. Steinbach, the
head physician of the county hospital.
For a whole month he spread crumbs on the window-sill every
morning at five minutes to eight; the birds gathered as punctually,
and by eight o’clock the “table” was cleared and not a crumb
remained. So far, the experiment was a great delight to the children,
Guy and Flo, who were all agog to know how the birds knew the
time.
After a month of free breakfasts: “You shall see now whether or
no the birds come because they see the crumbs.” The prospect was
delightful, but, alas! this stage of the experiment was very much
otherwise to the pitiful childish hearts.
“Oh, father, please let us put out crumbs for the poor little birds,
they are so hungry!” a prayer seconded by Mrs. Belmont, met with
very ready acceptance. The best of us have our moments of
weakness.
“Very interesting,” said the two savants. “Nothing could show
more clearly the readiness with which a habit is formed in even the
less intelligent of the creatures.”
“Yes, and more than that, it shows the automatic nature of the
action once the habit is formed. Observe, the birds came punctually
and regularly when there were no longer crumbs for them. They did
not come, look for their breakfast, and take sudden flight when it was
not there, but they settled as before, stayed as long as before, and
then flew off without any sign of disappointment. That is, they came,
as we set one foot before another in walking, just out of habit,
without any looking for crumbs, or conscious intention of any sort, a
mere automatic or machine-like action with which conscious thought
has nothing to do.”
Of another little experiment Mr. Belmont was especially proud,
because it brought down, as it were, two quarries at a stroke;
touched heredity and automatic action in one little series of
observations. Rover, the family dog, appeared in the first place as a
miserable puppy saved from drowning. He was of no breed to speak
of, but care and good living agreed with him. He developed a
handsome shaggy white coat, a quiet, well-featured face, and
betrayed his low origin only by one inveterate habit; carts he took no
notice of, but never a carriage, small or great, appeared in sight but
he ran yelping at the heels of the horses in an intolerable way,
contriving at the same time to dodge the whip like any street Arab.
Oddly enough, it came out through the milkman that Rover came of
a mother who met with her death through this very peccadillo.
Here was an opportunity. The point was, to prove not only that the
barking was automatic, but that the most inveterate habit, even an
inherited habit, is open to cure.
Mr. Belmont devoted himself to the experiment: he gave orders
that, for a month, Rover should go out with no one but himself. Two
pairs of ears were on the alert for wheels; two, distinguished
between carriage and cart. Now Rover was the master of an
accomplishment of which he and the family were proud: he could
carry a newspaper in his mouth. Wheels in the distance, then, “Hi!
Rover!” and Rover trotted along, the proud bearer of the Times. This
went on daily for a month, until at last the association between
wheels and newspaper was established, and a distant rumble would
bring him up—a demand in his eyes. Rover was cured. By-and-by
the paper was unnecessary, and “To heel! good dog!” was enough
when an ominous falling of the jaw threatened a return of the old
habit.
It is extraordinary how wide is the gap between theory and
practice in most of our lives. “The man who knows the power of habit
has a key wherewith to regulate his own life and the lives of his
household, down to that of the cat sitting at his hearth.” (Applause.)
Thus, Mr. Belmont at a scientific gathering. But only this morning did
it dawn upon him that, with this key between his fingers, he was
letting his wife’s health, his child’s life, be ruined by a habit fatal alike
to present peace, and to the hope of manly self-possession in the
future. Poor man! he had a bad half-hour that morning on his way
Citywards. He was not given to introspection, but, when it was forced
upon him, he dealt honestly.
“I must see Steinbach to-night, and talk the whole thing out with
him.”
 “Ah, so; the dear Guy! And how long is it, do you say, since the
boy has thus out-broken?”
“All his life, for anything I know—certainly it began in his infancy.”
“And do you think, my good friend”—here the Doctor laid a hand
on his friend’s arm, and peered at him with twinkling eyes and
gravely set mouth—“do you think it possible that he has—a—
inherited this little weakness? A grandfather, perhaps?”
“You mean me, I know; yes, it’s a fact. And I got it from my father,
and he, from his. We’re not a good stock. I know I’m an irascible
fellow, and it has stood in my way all through life.”
“Fair and softly, my dear fellow! go not so fast. I cannot let you say
bad things of my best friend. But this I allow; there are thorns,
bristles all over; and they come out at a touch. How much better for
you and for Science had the father cured all that!”
“As I must for Guy! Yes, and how much happier for wife, children,
and servants; how much pleasanter for friends. Well, Guy is the
question now. What do you advise?”
The two sat far into the night discussing a problem on the solution
of which depended the future of a noble boy, the happiness of a
family. No wonder they found the subject so profoundly interesting
that two by the church clock startled them into a hasty separation.
Both ladies resented this dereliction on the part of their several lords.
They would have been meeker than Sarah herself had they known
that, not science, not politics, but the bringing up of the children, was
the engrossing topic.

Breakfast-time three days later. Scene, the dining-room.

Nurse in presence of Master and Mistress.
“You have been a faithful servant and good friend, both to us and
the children, Harriet, but we blame you a little for Guy’s passionate
outbreaks. Do not be offended, we blame ourselves more. Your
share of blame is that you have worshipped him from his babyhood,
and have allowed him to have his own way in everything. Now, your
part of the cure is, to do exactly as we desire. At present, I shall only
ask you to remember that, Prevention is better than cure. The thing
for all of us is to take precautions against even one more of these
outbreaks.
“Keep your eye upon Guy; if you notice—no matter what the
cause—flushed cheeks, pouting lips, flashing eye, frowning
forehead, with two little upright lines between the eyebrows, limbs
held stiffly, hands, perhaps, closed, head thrown slightly back; if you
notice any or all of these signs, the boy is on the verge of an
outbreak. Do not stop to ask questions, or soothe him, or make
peace, or threaten. Change his thoughts. That is the one hope. Say
quite naturally and pleasantly, as if you saw nothing, ‘Your father
wants you to garden with him,’ or, ‘for a game of dominoes;’ or, ‘your
mother wants you to help her in the store-room,’ or, ‘to tidy her work-
box.’ Be ruled by the time of the day, and how you know we are
employed. And be quite sure we do want the boy.”
“But, sir, please excuse me, is it any good to save him from
breaking out when the passion is there in his heart?”
“Yes, Harriet, all the good in the world. Your master thinks that
Guy’s passions have become a habit, and that the way to cure him is
to keep him a long time, a month or two, without a single outbreak; if
we can manage that, the trouble will be over. As for the passion in
his heart, that comes with the outer signs, and both will be cured
together. Do, Harriet, like a good woman, help us in this matter, and
your master and I will always be grateful to you!”
“I’m sure, ma’am,” with a sob (Harriet was a soft-hearted woman,
and was very much touched to be taken thus into the confidence of
her master and mistress). “I’m sure I’ll do my best, especially as I’ve
had a hand in it; but I’m sure I never meant to, and, if I forget, I hope
you’ll kindly forgive me.”
“No, Harriet, you must not forget, any more than you’d forget to
snatch a sharp knife from the baby. This is almost a matter of life and
death.”
“Very well, sir; I’ll remember, and thank you for telling me.”
 Breakfast-time was unlucky; the very morning after the above talk,
Nurse had her opportunity. Flo, for some inscrutable reason,
preferred to eat her porridge with her brother’s spoon. Behold, quick
as a flash, flushed cheeks, puckered brow, rigid frame!
“Master Guy, dear,” in a quite easy, friendly tone (Harriet had
mastered her lesson), “run down to your father; he wants you to help
him in the garden.”
Instantly the flash in the eye became a sparkle of delight, the rigid
limbs were all active and eager; out of his chair, out of the room,
downstairs, by his father’s side in less time than it takes to tell. And
the face—joyous, sparkling, full of eager expectation—surely Nurse
had been mistaken this time? But no; both parents knew how quickly
Guy emerged from the shadow of a cloud, and they trusted Harriet’s
discretion.
“Well, boy, so you’ve come to help me garden? But I’ve not done
breakfast. Have you finished yours?”
“No, father,” with a dropping lip.
“Well, I’ll tell you what. You run up and eat your porridge and
come down as soon as you’re ready; I shall make haste, too, and we
shall get a good half-hour in the garden before I go out.”
Up again went Guy with hasty, willing feet.
“Nurse” (breathless hurry and importance), “I must make haste
with my porridge. Father wants me directly to help him in the
garden.”
Nurse winked hard at the fact that the porridge was gobbled. The
happy little boy trotted off to one of the greatest treats he knew, and
that day passed without calamity.
 “I can see it will answer, and life will be another thing without
Guy’s passions; but do you think, Edward, it’s right to give the child
pleasures when he’s naughty—in fact, to put a premium upon
naughtiness, for it amounts to that?”
“You’re not quite right there. The child does not know he is
naughty; the emotions of ‘naughtiness’ are there; he is in a physical
tumult, but wilfulness has not set in; he does not yet mean to be
naughty, and all is gained if we avert the set of the will towards
wrong doing. He has not had time to recognise that he is naughty,
and his thoughts are changed so suddenly that he is not in the least
aware of what was going on in him before. The new thing comes to
him as naturally and graciously as do all the joys of the childish day.
The question of desert does not occur.”

For a week all went well. Nurse was on the alert, was quick to
note the ruddy storm-signal in the fair little face; never failed to
despatch him instantly, and with a quiet unconscious manner, on
some errand to father or mother; nay, she improved on her
instructions; when father and mother were out of the way, she herself
invented some pleasant errand to cook about the pudding for dinner;
to get fresh water for Dickie, or to see if Rover had had his breakfast.
Nurse was really clever in inventing expedients, in hitting instantly on
something to be done novel and amusing enough to fill the child’s
fancy. A mistake in this direction would, experience told her, be fatal;
propose what was stale, and not only would Guy decline to give up
the immediate gratification of a passionate outbreak—for it is a
gratification, that must be borne in mind—but he would begin to look
suspiciously on the “something else” which so often came in the way
of this gratification.
Security has its own risks. A morning came when Nurse was not
on the alert. Baby was teething and fractious, Nurse was overdone,
and the nursery was not a cheerful place. Guy, very sensitive to the
moral atmosphere about him, got, in Nurse’s phrase, out of sorts. He
relieved himself by drumming on the table with a couple of ninepins,
just as Nurse was getting baby off after a wakeful night.
“Stop that noise this minute, you naughty boy! Don’t you see your
poor little brother is going to sleep?” in a loud whisper. The noise
was redoubled, and assisted by kicks on chair-rungs and table-legs.
Sleep vanished and baby broke into a piteous wail. This was too
much; the Nurse laid down the child, seized the young culprit, chair
and all, carried him to the furthest corner, and, desiring him not to
move till she gave him leave, set him down with a vigorous shaking.
There were days when Guy would stand this style of treatment
cheerfully, but this was not one. Before Harriet had even noted the
danger signals, the storm had broken out. For half-an-hour the
nursery was a scene of frantic uproar, baby assisting, and even little
Flo. Half-an-hour is nothing to speak of; in pleasant chat, over an
amusing book, the thirty minutes fly like five; but half-an-hour in
struggle with a raging child is a day and a night in length. Mr. and
Mrs. Belmont were out, so Harriet had it all to herself, and it was
contrary to orders that she should attempt to place the child in
confinement; solitude and locked doors involved risks that the
parents would, rightly, allow no one but themselves to run. At last the
tempest subsided, spent, apparently, by its own force.
A child cannot bear estrangement, disapproval; he must needs
live in the light of a countenance smiling upon him. His passion over,
Guy set himself laboriously to be good, keeping watch out of the
corner of his eye to see how Nurse took it. She was too much vexed
to respond in any way, even by a smile. But her heart was touched;
and though, by-and-by, when Mrs. Belmont came in, she did say
—“Master Guy has been in one of his worst tempers again, ma’am:
screaming for better than half-an-hour”—yet she did not tell her tale
with the empressement necessary to show what a very bad half-hour
they had had. His mother looked with grave reproof at the
delinquent, but she was not proof against his coaxing ways.
After dinner she remarked to her husband, “You will be sorry to
hear that Guy has had one of his worst bouts again. Nurse said he
screamed steadily for more than half-an-hour.”
 “What did you do?”
“I was out at the time, doing some shopping. But when I came
back, after letting him know how grieved I was, I did as you say,
changed his thoughts and did my best to give him a happy day.”
“How did you let him know you were grieved?”
“I looked at him in a way he quite understood, and you should
have seen the deliciously coaxing, half-ashamed look he shot up at
me. What eyes he has!”
“Yes, the little monkey! and no doubt he measured their effect on
his mother; you must allow me to say that my theory certainly is not
to give him a happy day after an outbreak of this sort.”
“Why, I thought your whole plan was to change his thoughts, to
keep him so well occupied with pleasant things that he does not
dwell on what agitated him.”
“Yes, but did you not tell me the passion was over when you
found him?”
“Quite over, he was as good as gold.”
“Well, the thing we settled on was to avert a threatened outbreak
by a pleasant change of thought; and to do so in order that, at last,
the habit of these outbreaks may be broken. Don’t you see, that is a
very different thing from pampering him with a pleasant day when he
has already pampered himself with the full indulgence of his
passion?”
“Pampered himself! Why, you surely don’t think those terrible
scenes give the poor child any pleasure. I always thought he was a
deal more to be pitied than we.”
“Indeed I do. Pleasure is perhaps hardly the word; but that the
display of temper is a form of self indulgence, there is no doubt at all.
You, my dear, are too amiable to know what a relief it is to us irritable
people to have a good storm and clear the air.”
“Nonsense, Edward! But what should I have done? What is the
best course after the child has given way?”
 “I think we must, as you suggested before, consider how we
ourselves are governed. Estrangement, isolation, are the immediate
consequences of sin, even of what may seem a small sin of
harshness and selfishness.”
“Oh, but don’t you think that is our delusion? that God is loving us
all the time, and it is we who estrange ourselves?”
“Without doubt; and we are aware of the love all the time, but,
also, we are aware of a cloud between us and it; we know we are out
of favour. We know, too, there is only one way back, through the fire.
It is common to speak of repentance as a light thing, rather pleasant
than otherwise; but it is searching and bitter: so much so, that the
Christian soul dreads to sin, even the sin of coldness, from an almost
cowardly dread of the anguish of repentance, purging fire though it
is.”
Mrs. Belmont could not clear her throat to answer for a minute.
She had never before had such a glimpse into her husband’s soul.
Here were deeper things in the spiritual life than any of which she yet
knew.
“Well then, dear, about Guy; must he feel this estrangement, go
through this fire?”
“I think so, in his small degree; but he must never doubt our love.
He must see and feel that it is always there, though under a cloud of
sorrow which he only can break through.”

Guy’s lapse prepared the way for further lapses. Not two days
passed before he was again hors de combat. The boy, his outbreak
over, was ready at once to emerge into the sunshine. Not so his
mother. His most bewitching arts met only with sad looks and
silence.
He told his small scraps of nursery news, looking in vain for the
customary answering smile and merry words. He sidled up to his
mother, and stroked her cheek; that did not do, so he stroked her
hand; then her gown; no answering touch, no smile, no word;
nothing but sorrowful eyes when he ventured to raise his own. Poor
little fellow! The iron was beginning to enter; he moved a step or two
away from his mother, and raised to hers eyes full of piteous doubt
and pleading. He saw love, which could not reach him, and sorrow,
which he was just beginning to comprehend. But his mother could
bear it no longer: she got up hastily and left the room. Then the little
boy, keeping close to the wall, as if even that were something to
interpose between him and this new sense of desolation, edged off
to the furthest corner of the room, and sinking on the floor with a sad,
new quietness, sobbed out lonely sobs; Nurse had had her lesson,
and although she, too, was crying for her boy, nobody went near him
but Flo. A little arm was passed round his neck; a hot little cheek
pressed against his curls:
“Don’t cry, Guy!” two or three times, and when the sobs came all
the thicker, there was nothing for it but that Flo must cry too; poor
little outcasts!
At last bedtime came, and his mother; but her face had still that
sad, far-away look, and Guy could see she had been crying. How he
longed to spring up and hug her and kiss her as he would have done
yesterday. But somehow he dared not; and she never smiled nor
spoke, and yet never before had Guy known how his mother loved
him.
She sat in her accustomed chair by the little white bed, and
beckoned the little boy in his nightgown to come and say his prayers.
He knelt at his mother’s knee as usual, and then she laid her hands
upon him.
“‘Our Father’—oh, mother, mo—o—ther, mother!” and a torrent of
tears drowned the rest, and Guy was again in his mother’s arms, and
she was raining kisses upon him, and crying softly with him.
Next morning his father received him with open arms.
“So my poor little boy had a bad day yesterday!”
Guy hung his head and said nothing.
 “Would you like me to tell you how you may help ever having quite
such another bad day?”
“Oh yes, please, father; I thought I couldn’t help.”
“Can you tell when the ‘Cross-man’ is coming?”
Guy hesitated. “Sometimes, I think. I get all hot.”
“Well, the minute you find he’s coming, even if you have begun to
cry, say, ‘Please excuse me, Nurse,’ and run downstairs, and then
four times round the garden as fast as you can, without stopping to
take breath!”
“What a good way! Shall I try it now?”
“Why, the ‘Cross-man’ isn’t there now. But I’ll tell you a secret: he
always goes away if you begin to do something else as hard as you
can; and if you can remember to run away from him round the
garden, you’ll find he won’t run after you; at the very worst, he won’t
run after you more than once round!”
“Oh, father, I’ll try! What fun! See if I don’t beat him! Won’t I just
give Mr. ‘Cross-man’ a race! He shall be quite out of breath before
we get round the fourth time.”
The vivid imagination of the boy personified the foe, and the
father jumped with his humour. Guy was eager for the fray; the
parents had found an ally in their boy; the final victory was surely
within appreciable distance.

“This is glorious, Edward; and it’s as interesting as painting a

picture or writing a book! What a capital device the race with Mr.
‘Cross-man’ is! It’s like ‘Sintram.’ He’ll be so much on the qui vive for
‘Cross-man’ that he’ll forget to be cross. The only danger I see is that
of many false alarms. He’ll try the race, in all good faith, when there
is no foe in pursuit.”
 “That’s very likely; but it will do no harm. He is getting the habit of
running away from the evil, and may for that be the more ready to
run when ’tis at his heels; this, of running away from temptation, is
the right principle, and may be useful to him in a thousand ways.”
“Indeed, it may be a safeguard to him through life. How did you
get the idea?”
“Do you remember how Rover was cured of barking after
carriages? There were two stages to the cure; the habit of barking
was stopped, and a new habit was put in its place; I worked upon the
recognised law of association of ideas, and got Rover to associate
the rumble of wheels with a newspaper in his mouth. I tried at the
time to explain how it was possible to act thus on the ‘mind’ of a
dog.”
“I recollect quite well, you said that the stuff—nervous tissue, you
called it—of which the brain is made is shaped in the same sort of
way—at least so I understood—by the thoughts that are in it, as the
cover of a tart is shaped by the plums below. And then, when there’s
a place ready for them in the brain, the same sort of thoughts always
come to fill it.”
“I did not intend to say precisely that,” said Mr. Belmont, laughing,
“especially the plum part. However, it will do. Pray go on with your
metaphor. It is decided that plums are not wholesome eating. You
put in your thumb, and pick out a plum; and that the place may be
filled, and well filled, you pop in a—a—figures fail me—a peach!”
“I see! I see! Guy’s screaming fits are the unwholesome plum
which we are picking out, and the running away from Cross-man the
peach to be got in instead. (I don’t see why it should be a peach
though, unpractical man!) His brain is to grow to the shape of the
peach, and behold, the place is filled. No more room for the
plum.”[21]
“You have it; you have put, in a light way, a most interesting law,
and I take much blame to myself that I never thought, until now, of
applying it to Guy’s case. But now I think we are making way; we
have made provision for dislodging the old habit and setting a new
one in its place.”
“Don’t you think the child will be a hero in a very small way, when
he makes himself run away from his temper?”
“Not in a small way at all; the child will be a hero. But we cannot
be heroes all the time. In sudden gusts of temptation, God grant him
grace to play the hero, if only through hasty flight; but in what are
called besetting sins, there is nothing safe but the contrary besetting
good habit. And here is where parents have such infinite power over
the future of their children.”
“Don’t think me superstitious and stupid; but somehow this
scientific training, good as I see it is, seems to me to undervalue the
help we get from above in times of difficulty and temptation.”
“Let me say that it is you who undervalue the virtue, and limit the
scope of the Divine action. Whose are the laws Science labours to
reveal? Whose are the works, body or brain, or what you like, upon
which these laws act?”
“How foolish of me! How one gets into a way of thinking that God
cares only for what we call spiritual things. Let me ask you one more
question. I do see that all this watchful training is necessary, and do
not wish to be idle or cowardly about it. But don’t you think Guy
would grow out of these violent tempers naturally, as he gets older?”
“Well, he would not, as youth or man, fling himself on the ground
and roar; but no doubt he would grow up touchy, fiery, open at any
minute to a sudden storm of rage. The man who has too much self-
respect for an open exhibition may, as you know well enough, poor
wife, indulge in continual irritability, suffer himself to be annoyed by
trifling matters. No, there is nothing for it but to look upon an irate
habit as one to be displaced by a contrary habit. Who knows what
cheerful days we may yet have, and whether in curing Guy I may not
cure myself? The thing can be done; only one is so lazy about one’s
own habits. Suppose you take me in hand?”
“Oh, I couldn’t! and yet it’s your only fault, dear.”
 “Only fault! well, we’ll see. In the meantime there’s another thing I
wish we could do for Guy—stop him in the midst of an outbreak. Do
you remember the morning we found him admiring himself in the
glass?”
“Yes, with the photograph in his hand.”
“That was it; perhaps the Cross-man race will answer even in the
middle of a tempest. If not, we must try something else.”
“It won’t work.”
“Why not?”
“Guy will have no more rages; how then can he be stopped in
mid-tempest?”
“Most hopeful of women! But don’t deceive yourself. Our work is
only well begun, but that, let us hope, is half done.”

His father was right. Opportunities to check him in mid-career

occurred; and Guy answered to the rein. Mr. Cross-man worked
wonders. A record of outbreaks was kept; now a month intervened;
two months; a year; two years; and at last his parents forgot their
early troubles with their sweet-tempered, frank-natured boy.

FOOTNOTES:
[21] To state the case more accurately, certain cell
connections appear to be established by habitual traffic in
certain thoughts; but there is so much danger of over-
stating or of localising mental operations, that perhaps it is
safe to convey the practical outcome of this line of research
in a more or less figurative way—as, the wearing of a field-
path; the making of a bridge; a railway, &c.
 CHAPTER II

ATTENTION.
“But now for the real object of this letter (does it take your breath
away to get four sheets?) We want you to help us about Kitty. My
husband and I are at our wits’ end, and should most thankfully take
your wise head and kind heart into counsel. I fear we have been
laying up trouble for ourselves and for our little girl. The ways of
nature are, there is no denying it, very attractive in all young
creatures, and it is so delightful to see a child do as ‘’tis its nature to,’
that you forget that Nature, left to herself, produces a waste, be it
never so lovely. Our little Kitty’s might so easily become a wasted
life.
“But not to prose any more, let me tell you the history of Kitty’s
yesterday—one of her days is like the rest, and you will be able to
see where we want your help.
“Figure to yourself the three little heads bent over ‘copy-books’ in
our cheery schoolroom. Before a line is done, up starts Kitty.
“‘Oh, mother, may I write the next copy—s h e l l? “Shell” is so
much nicer than—k n o w, and I’m so tired of it.’
“‘How much have you done?’
“‘I have written it three whole times, mother, and I really can’t do it
any more! I think I could do—s h e l l. “Shell” is so pretty!’
“By-and-by we read; but Kitty cannot read—can’t even spell the
words (don’t scold us, we know it is quite wrong to spell in a reading
lesson), because all the time her eyes are on a smutty sparrow on
the topmost twig of the poplar; so she reads, ‘W i t h, birdie!’ We do
sums; a short line of addition is to poor Kitty a hopeless and an
endless task. ‘Five and three make—nineteen,’ is her last effort,
though she knows quite well how to add up figures. Half a scale on
the piano, and then—eyes and ears for everybody’s business but her
own. Three stitches of hemming, and idle fingers plait up the hem or
fold the duster in a dozen shapes. I am in the midst of a thrilling
history talk: ‘So the Black Prince——’ ‘Oh, mother, do you think we
shall go to the sea this year? My pail is quite ready, all but the
handle, but I can’t find my spade anywhere!’
“And thus we go on, pulling Kitty through her lessons somehow;
but it is a weariness to herself and all of us, and I doubt if the child
learns anything except by bright flashes. But you have no notion how
quick the little monkey is. After idling through a lesson she will
overtake us at a bound at the last moment, and thus escape the
wholesome shame of being shown up as the dunce of our little party.
“Kitty’s dawdling ways, her restless desire for change of
occupation, her always wandering thoughts, lead to a good deal of
friction, and spoil our schoolroom party, which is a pity, for I want the
children to enjoy their lessons from the very first. What do you think
the child said to me yesterday in the most coaxing pretty way?
‘There are so many things nicer than lessons! Don’t you think so,
mother?’ Yes, dear aunt, I see you put your finger on those unlucky
words ‘coaxing, pretty way,’ and you look, if you do not say, that
awful sentence of yours about sin being bred of allowance. Isn’t that
it? It is quite true; we are in fault. Those butterfly ways of Kitty’s were
delicious to behold until we thought it time to set her to work, and
then we found that we should have been training her from her
babyhood. Well,
‘If you break your plaything yourself, dear,
Don’t you cry for it all the same?
I don’t think it is such a comfort
To have only oneself to blame.’

“So, like a dear, kind aunt, don’t scold us, but help us to do better. Is
Kitty constant to anything? you ask. Does she stick to any of the
‘many things so much nicer than lessons’? I am afraid that here, too,
our little girl is ‘unstable as water.’ And the worst of it is, she is all