Hello, my name is
Steve Bowen, and in this lecture you will learn Wireshark packet
capture approach, Europe, dependencies, capture filters, etc.
In detail.
In this section we are covering basics to get you started with Wireshark
and here in order to start the version, you can also go to the application
menus here and write Wireshark in the search button
and you need to start my truck as a route user with superuser privileges.
You can enter the password menu in the style look appears
and you can see that everything you need the network adapters and so on.
So you can also start the one shot from the terminal in order to start terminal.
If you just write the Wireshark here and here, as you can see here
we can see the Ethernet or any network interface cards.
That's why we need to start by Ishaq on Sudo Wireshark.
He will enter the password
and that SSIDs amongst the bunch of application is launched.
The main interface is shown, including sections
for basic capture controls, capture filters and display filters.
Now you will select the desired interface from the list
by clicking and hit the start capture button to capture.
In this case, we have the Ethernet zero and any.
You can also select the information in this case,
it will also listen to ability to wifi and so on.
In this case we will select the Ethernet because we don't have any connected device
to the internet.
And here that said, so we started Ethernet.
If anything occurs and as you can see here, our
router
and switches it are talking can here, as you can see here,
who has this IP address held to this IP address.
And as you can see here, there's a like I'm so excited with version here.
So here we have we can start the capture here.
So the capture from here and you can specify the filters and that's it.
So event capture is in progress by default.
It shows live the packets being captured in various colors.
And we can start again here so we can go to our vulnerable.
Verification here in this case is to front target.com and let's log out.
And whenever we are doing something on the
Wireshark or
whenever someone does something on our local area network,
it will show us the exact bytes byte by a bytes representation.
And here that we can start stop capture with this buttons here.
And let's first understand the packets here, right?
So it's time to investigate a capture at the individual level
and this is an example of one of the TCB packets captured here.
Now we will
go to here and enter our passwords.
Right.
So that's a for example, consider this as a Facebook
or any banking
website here.
So now we will have a dominant
will enter our password and that's it.
Now my shirt should capture this.
And yet, as you can see here,
we are seeing something less actually stop it now.
We will analyze it.
And here we are seeing something neat as it like login.
Here we're going to be and this you can see here,
it's application, that double double form.
You are all encoded here.
So now let's select this by clicking on and you can select the packets.
And here in this here you the packet details will appear this actually is the
grommet here I will graph into the screen.
That's it.
And here we have
the let's start the grommet.
Here we have toggle painting, clear screen and yes,
as you can see here, we also have the
application drawing thing.
That's it.
So now
when the packet is selected, Wireshark
opens the bottom panel here you can see here,
bottom panel, this is the bottom panel of Wireshark.
So this path the which gives important information of the on the features
that are conveniently presented in the same way
as the OSA model.
So the number of layers seen changes as the protocols are like the change here.
In this example from the top down we can see the frame layer.
Now it has the protocol. HTP
As you can see here,
and it's in the eternal datalink layer.
And there we can also see the IP network layer.
We have Ethernet to Internet protocol version four, source address
and this nation address, transmission protocol
and we have port and so on.
And we also have the Hypertext Transfer Protocol, which, we will get some
pretty confident information, confidential information from that here.
So we will get the passwords we entered
the last time we visited our website, right?
So if there are more layers or headers in the packet,
it is sequential decoded in the Wireshark packet view.
So for a packet with multiple encapsulation protocols
to decode as properly, there must be in this sector available
that request the corresponding protocol layer.
So every packet decode starts with a frame.
The sector right it the sex,
the detail of the captured metadata itself.
you can call
the timestamps, right so that the frame dissector passes
the data to the lowest level data dissector in the data link layer.
For example, the ether Ethernet,
the sector gets triggered from the for eternity either.
So the packet is then passed to the next Dissector and the network layer,
for example IP, IP vision four
or version six, Dissector gets triggered and so on.
So each stage of the sectors decodes and displays
the details of the packet
and the sectors kind of write it as self registering, plug in,
for example their shared library or DLR
or built into the Wireshark source code.
So the biggest benefit of going with the plug
in approach is that removing a plugin is much faster
and if that a sector is built into the source code,
the Wireshark needs to be completely recompiled and rebuilt.
Hence it makes more sense to write in the sector as a plug in.
Right.
So you will learn more details on this sectors in our next lectures also.
But let's firstly get started with the capture of filters in Wireshark,
so we will discuss in detail capture filters and next lectures.
But all the basics have been included here in the section
for completeness on getting started discussion.
So capture filters are used to decrease the size of captures
by filtering out all the relevant packets, matching
the condition before they are added to the capture file.
So clicking on the capture options button
shows a screen containing a list of interfaces.
So in order to do that, you will need to find this setting icon.
And it's usually there and here
and clicking on that you will see this dialog here.
So now to set a filter, either an interface can be double
clicked like this or a custom filter can be entered in the box.
Right? So
now we will open that again.
Or before that, let's actually enter our password again because our
previous packet analysis is lost because we don't save them
as earlier and that's it.
And now we're going to see the post log in here.
This is usually the logging pages
that uses the Post method.
And here now we will go to that again.
So we stopped the filter and here we as I said, you can double click on the
after options.
But remember before thinking on an interface on the style,
you need to save the file in order to get lost in captured interface.
So here to set the filter,
you can also select the custom filter.
Can be entered in the textbooks.
So there is a list here
that shows example of simple capture filters.
For example, we can use the CRC here
as SA
C post, so we will enter the RSA seahorse.
So let's actually scan our host with maps.
So in map is we here from the fun
target dot com
and now we will get that has no main
IP address IP address and now
sorry,
we'll just put this here.
Yes, we can see the IP address here.
192168 13 142 and now we will use this filter
to just listen to the Packers from this host.
And here in order today that we will just write that IP
address down
just 13 point s142
and you can present start and
we can also save them
before starting a new captures.
We will not save them in this course.
And here, as you can see here, whenever we restart
this page, there is something new will come here.
And as you can see here, it's
the new information is gathering.
So now we will go presently log out.
And here we also have this, 3021,
and we can read it from the Hypertext Transfer Protocol.
We have no catch,
connect, type, connect, length, and so on.
Now, what we're going to do is we will do that example again.
We will enter our passwords, in this case admin and or password.
That's it.
And click on log in and here as you can see here, you are seeing that familiar
POS request.
Again.
Yes, we have this, this, this here
slogan, No, go up again
the here and
password
and here.
As you can see here, we have several information here.
So you can also use another
filters as well like net, right.
So we can with this net here,
you will be the latest and 24 subnet mask.
So we will listen to the packets to
and from a whole host part of the network here.
So from 0 to 255 IP address.
Right, Right.
So we can also use the port here
port and we will listen to only packets
that connected within this port here.
So communicating with this port here and
now, since we are communicating on Port eight,
we will see informations here
and we also have the display filters
on Wireshark, which we will discuss in next lecture.
My name is Slave one and I'm waiting in the next lecture.