Ok, welcome. Today, we are going to play around with Wireshark.
Now, we can literally spend
80 to 120 hours even two months working specifically on Wireshark so that you
could understand all the ins and outs and become a true expert at it.
However,
for cys A, you don't need to be an expert,
you just need to basically understand how to read wire sharp
and not even that much of an in depth
level as much as understanding what you're looking at.
So we're going to do a basic setup for Wireshark.
I'm gonna show you some key features and then I'm
going to show you how to read some of the information
and that's pretty much it.
So it should take about 10 minutes, very high level overview of what
shark is
uh and everything that's associated with it. So
let's dive into it. The very first thing I need to do is actually open up Wireshark.
I'm gonna open up my terminal
and blow that up so you can see it.
And I'm just gonna type in Wireshark just like that.
Now, Wireshark because it's operating on my VirtualBox.
Uh It doesn't have any traffic going through it right now,
there's nothing going in or out of it, which means you can't really see the line.
So let's put
some traffic on wireshark. I'm gonna open up a new terminal.
I'm just gonna do an in map. I already got the
optics one running in the background. So I'm just gonna do an in map to that.
Kops one.
If you can't see it here, you can,
we've already identified that the
optics one is on 10.0 0.2 0.11.
I'm gonna run that and we should see
some traffic. Now on WireShark. Now, I've got
Ethernet zero,
which is the main traffic line coming into it. I've also got any. Now,
I would recommend that you utilize the any
when we're going through Wireshark in a lab environment.
That's what we're gonna do today.
If you have or if you're using Wireshark for a specific purpose,
then identifying the exact port in which the
traffic is coming out is probably better.
But for today's purposes, we're just gonna do any
you can see here again, no traffic coming through.
Uh
We have our number,
right? We just had a spur of traffic come in.
We've got our number that is the traffic that's currently
processing
on there.
The time
that is the time since we started WireShark.
That means this is the very first packet from this point forward, displayed account
where each traffic comes after that for instance from packet one which it was 0000.
The packet number two was 0.014 seconds
after the first packet came in
and point
or packet number three or number three was 0.075 or excuse me, 5.075 seconds after
the first packet came in and you can kind of go through and see that as it goes through.
Right. We have our source IP, that's the IP address that it came from.
You have to realize that Wireshark is looking at traffic both from A
from
and then to a two. Which means that if I pull up MS paint,
if you look at Wireshark and we have two computers, we have computer A
and we have computer B
right here. Now between the two, we have traffic that goes both ways.
Wireshark looks at it, not like this but like this,
there are two different streams of traffic,
meaning that traffic is either going from B to A or from A to B.
And it emphasizes that in the way that it processes information.
So in this context, we have source,
right? 10.029 that's traffic coming from there from the source IP address of 2.9
to the destination IP address of 2.3.
When it reverts back,
it's providing or when 2.3 responds, I should say when 2.9 responds,
I cannot talk today.
Uh We're seeing
from 2.3 to 2.9. So for instance, traffic is going from
2.9222 0.3
and then from 2.3 to 2.9 and we're kind of sitting in the
middle looking at both traffic lights and that's what we're doing today,
right?
So those are our source and destination IP addresses and then we have our protocol.
What protocol is it operating on?
In this case for one and two, it's DHCP four lines three and four or P
three and four. It is on ARP address resolution protocol.
Then we can see the length that's the length
of traffic that's going through and then a basic informational
uh of what's going on, right? This is very, very basic, right?
For instance, on number three,
we see that it's saying who has 2.3 and it's going to tell 2.9 that's what it's doing.
So let's provide some context to this. Well, first let's set this up, right?
Uh for basic setup for wireshark, especially the first time you're using it.
I like to add my source port and my destination. Now, I can find
that information
right here. Under use of datagram protocol.
It tells me that the source port is 68 and the station port is 67.
But I want to view it up here to do that. I'm going to right, click anywhere on this bar
and I'm going to do column, preferences under column, preferences.
On the right hand side, we can add columns.
I'm going to push that plus sign
twice
and you can see that it added to columns for me right here and right here, I'm gonna put
the first one, just double left click and I'm just gonna put SRC ports,
enter and then for the next one, I'm just going to double click and put DS T port
right there.
And now I've got my source port and destination port, but I need to tie that.
So for my source port, I'm gonna double click again
and I'm going to drag it down to source port resolved
right here, source port resolved.
And for my destination port again, I'm going to
put destination port
resolved.
I press, OK?
And then you can't see it yet, but it's all the way on the right hand side.
So I'm gonna grab that.
I'm gonna move it over to the source port
and then I'm gonna grab the other one
and move that over to the destination.
So now
if I look at this, I've got time source and then source port
and destination and the destination port.
If the numbers don't add up or the columns are too small or when
you can just double click
and it will fix that for you
so that you can actually read it. Now, I would recommend
spanning your destination out a little bit
because you may find out that it's not enough space.
So let's dive into this a little bit. Let me do a basic internet search.
Let's go into Firefox real quick
and let's just go to Google.
I'm just gonna hit Google. That's it.
And I'm gonna go back to Wireshark and look
at all the traffic that's associated with it.
Look at all that juicy traffic.
All right, let's say that I wanted to look at a specific IP address.
Let's say I wanted to look at 2.9
like 2.9 is something I wanted to see.
I could do
IP
and then just by typing IP
it's got all these little shortcuts that I can do. I could do
dation which means I click on that and press enter.
It's only going to show me a
traffic that is going to
IP address two dots
none right now. But what if I did
address?
Let me throw that equal sign back in there
and hit enter
and you can see that IP address 2 to 11.
We're not seeing any traffic. What about nine?
What if we did nine?
There we go.
That means that it's gonna show all traffic going into IP address 2.9.
Now,
I did to a lot of it because I've got Coptic
running in the background and I forgot to ping it,
but that's ok.
That's great. Let's do that. Now, let's let's jump into this.
We can see here that I've got 211. Let's just hit a ping
10.0 0.2 0.11 just like that.
It's gonna start pinging it.
I can go back into here and then I can do 11.
But instead of doing IP address, let's do destination.
So I'm going to do IP and then DS T
and now it's providing me all that juicy information.
Right.
So we're doing a ping against
211 and it's providing that information,
ok?
If I stop that
control C to stop that,
it should stop traffic
on there.
Now, this entire time, I've actually been capturing this data.
I've been saving this data and I go to file and then I can do a
save.
Well, I have to stop it first, but I have to stop the traffic, then I can do a file
and then save and I can save this as a PCAP file.
And you can see here wire sharp
pap. I'm not gonna do that right now,
but just realize that is how you get a PCAP file. OK?
So I've got all this information.
Let's say that I wanted to get back to the original information.
I could literally just delete all this
right there, hit enter and now I'm back at where I originally was. OK?
You can see here that the eight isn't actually accurate if I click on that.
Now, you can see that I'm actually in the Hinter range and if I scroll all the way down
and just add a little bit of traffic that I've done.
It's that little bit of traffic you can see here
and I am quite high on the traffic
on 904 packets already.
Ok.
So this is WireShark very high level. Let's dive into this
context here. Let me find a good one.
Here's a basic traffic, right?
This first one is in private the frames and this goes
a lot of the OS I model if you remember that.
So here's our IP S our internet protocol version
and we could drive into this. We can see our destination sort IP addresses.
Uh I could expand these
and go into different services.
Uh I can go through here and provide that. We can see the time to live for 255.
We see our protocols, TCP,
we can see our check or check some validation is disabled but we see our checks.
I can expand our transmissions for coal.
Let me
reduce this. There we go.
And this TCP provides us what our source port is. If it's not available up here,
we can see the destination port 40,134 our stream index
and we can go through and really start to see this. We can also see our time stamps
both from the perspective of time sense, first TCP stream or in this TCP stream
and then time sense this and PV C stream. We can also do a sequence and analysis.
And we see that information.
Uh This is the basics of wireshark,
very high level, uh
very much something that you should understand the basic principles of.
Now, cys A doesn't go into that much depth with wireshark.
It does expect you to understand what an
EO and P is. It basically understands how wireshark works.
You should understand the basic principles of Wireshark as far as CYC.
Don't expect some in depth questions on there.
Don't expect that it's asked you specifically how do you use wireshark
or the different filters?
They might provide you a different context of this,
of a little screenshot of wireshark and expect you to understand how to read it.
But I wouldn't expect to see anything much more in depth with that
very quick overview of wireshark. I hope this was helpful.
We will see you in our next uh showcase, talk to you later.