In this lecture, I want to introduce you to the program Wireshark.
Important legal disclaimer here for this lecture.
First, of course, this is not legal advice.
This is just a disclaimer to emphasize certain things.
Wireshark is quite a powerful network tool.
It can intercept, monitor and analyze network traffic.
This might be illegal if you do this to a network to network traffic that is not yours.
So you should be aware of that.
The next thing is that Wireshark might capture sensitive information that is transmitted through the
network, and sensitive information might also just be private or information that is considered private.
And this might, depending on the place where you live, even be Mac addresses, which are pretty much
always captured, even if they encryption itself, would the connection itself that we would capture
would be encrypted.
So it might be that you just by running Wireshark on your computer, you might be capturing sensitive
or private information of others.
And this might be considered illegal depending on the laws of the country of where you are doing this.
Be also aware that laws might be different depending on your jurisdiction.
So it might even be depending on where you live, it might be more lax, it might be more easy with
using Wireshark or it might be more strict than in the country where I am right now.
I'm in Europe.
So in my case, using Wireshark for ethical use cases is legal.
Ethical use cases would be like learning, teaching, ethical hacking, like probing for vulnerabilities.
But I'm still not allowed to log private information of others.
And as far as I understand it, a mac address which will always be logged whenever we turn on Wireshark,
is already considered private information, at least in the European Union.
So I need to be aware of that.
In my case, I'm living alone.
So I got quite a few internet devices because I got a smart home.
But all the internet devices that I use in my network are mine, so it's only my own private information
that I'm logging and then leaking because I'm filming it in the video.
So I can make I can just do this here.
In your case, it might you might need to ask your network administrators or all the and or all other
users of the network if it's okay to use Wireshark and to log the network traffic.
And you should consider checking the laws of your country or your state.
What's allowed there or not.
I can't really do that for you because I don't know where you are.
But one thing I can say is that I have a feeling that usually my case, the way the laws are here,
this is pretty safe.
And pretty much all countries that as long as you're using Wireshark for ethical use cases, that then
it's legal.
But you should still or you are still not allowed to log private information of others.
But again, this is not legal advice.
This is just a feeling that I'm having.
If you want legal advice or you want to clarify that, you need to talk to a local lawyer.
The software wireshark allows us to record and inspect network traffic.
This is a GUI application, like an application with a user interface.
I know this is more a command line course, but it's really important that we can visualize what's happening
on our network and Wireshark is the way to go here.
So before we continue, let's install this application on our system and then let's have a look at Wireshark,
how it can analyze our network traffic.
So let me switch over to my Linux system.
So here we are.
It's important that I'm not just in a terminal but with a user interface here and now I need to install
the Tool Wireshark.
So I say APT install Wireshark, and I just confirm this by entering my password.
And we can see here in this case Wireshark has already been installed because of course I tried whether
how it works and I tried this before recording this lecture here so it's already installed and we can
use it.
Wireshark needs additional privileges in order to work because it wants to access our network traffic
and that's something like a little bit more serious.
So we should not start it as a normal user.
The easiest way to do this is that we just use in a terminal sudo wireshark and this will then start
this application.
But as, as the the user root, if I now hit enter, we can see here this application now has started
and we can see here that we can now capture something here.
We get a list of network devices that we would like to.
Capture here.
In my case, my network card is called MP oh five, and I could now, for example, just capture this
so I can do a double click here.
And now all the network traffic here is being captured.
Let me now just open my browser here and let me now just for example, open or access a website, for
example, the website.
Let's access the website Google.com.
So here we are, we can see Google.com has been accessed.
And now I just stop this, this logging here because it does take quite a bit of space because everything
that we transfer through the network has been logged here.
So now we can see all the packages and all the data that has been transferred in that time.
It's not all from the Firefox, it's also from my network and other stuff that's happening in my network
that's also being recorded here.
So everything that we transfer to our network or that our the network transfers to us, this is everything
all that's being printed here.
And you can see it's quite a bit.
Let's see if we find this Google.com request here.
Let me just try to search here.
We can't find this one.
We want to filter by Http, so let's see if we have an Http request here and then we can see here.
Yeah, there were quite a few http requests, but no longer that many.
Let's have a look at, uh.
Let's scroll down.
There were quite a few requests here, but which one was for Google.com?
Um, maybe.
Actually, this one.
Uh, now, this is something else.
We need to fine tune that one.
Probably this one here.
Destination.
Let's have a look.
This was you can see it's a lot of information that's being displayed here.
But here we can see Google.com has been accessed.
So we have filtered that list here by searching for protocol Http.
And then we can see the actual data that has been transmitted here.
For example, here, Google.com.
And then the Firefox has sent that request here.
By the way, in case this request doesn't show up on your system, when you try to do the same, it
might be that Google.com has been accessed through Https, which is better because it's an encrypted
connection.
But this might mean that either it doesn't show up or it doesn't show up as Http, but as Https, Or
it might mean that we are not able to actually read the contents of the request in the same way that
you see here, because the whole connection is encrypted.
So just be aware of that.
If you are trying to do the same on your computer, please also note the actual data that has been transferred.
You can see here in the binary form, I'll add an error to visualize that.
But because this is really difficult to read, Wireshark makes it easier for us to read and prepares
the data for inspection for us.
All of this information here will become way more clear at the end of this chapter because while we
will work through all of those different nuances of how networking works and how those different layers
stack on top of each other, it will also be more clear why we have so many options here.
And what's a frame?
What's this one here?
It will all become more clear, but in order for me to be able to show this step by step, it's important
that we are aware of Wireshark and we are aware that this is the program that we can use to lock the
traffic on our network because then we can analyze it and see what's actually happening here.
So now we got the tools that we need to be able to understand our network.
I just a few seconds ago I talked a little bit about like different layers that are happening here during
network transmissions and how those layers work and what they mean and what's happening there.
This is what we'll have a look at in the next lecture.