Packet analysis is the process of gathering traffic on the network, decoding it and dissecting the
raw bits and presenting it in human readable format for analysis as shown here.
Gathering, Decoding.
Displaying and analyzing.
So regardless of the software used, there are four main phases of the packet analysis.
As I said in previous lectures, which is gather, decode, display and analyze.
In this section we will review each of the phases, starting with the first step is gather where we
collect data from the network.
So now let's go back to our Kali Linux.
It's actually Wireshark is independent from the operating system.
You can use Windows or Mac OS or operating system.
You want that Wireshark supports it.
So now let's go to Kali.
Here and here.
Yes, perfect.
Now open the.
Out here.
Yeah.
So let's launch Wireshark.
Wireshark.
So when you launch Wireshark, a welcome screen displays a list of available network connections on
your current device.
And this is in most cases, in most cases, you will have more than one interface.
And to begin capturing immediately, you can select an active spark line and begin capture apparently.
Now let's go to.
And you can also go to capture menu if you want and then go to options here.
So capture options.
So as you can see, there's also shortcut.
You can also click on the shortcut here.
This will same same screen will open here.
So now there's an keep in mind that there are two keys areas that will enable you to gather traffic,
which is capturing in promiscuous mode and using a capture engine.
So let's first discuss why it's important to enable promiscuous mode prior to capture.
So the capturing in promiscuous mode.
So when gathering traffic with Wireshark, you can capture on all interfaces however, so that you can
see all the traffic that is coming into the network interface card.
Make sure you select one of the following when on the input on the input tab of the capture options
dialog.
So check the box next to the interface under the promiscuous column header.
So, as you can see, enable promiscuous mode on all interface.
So.
Uh, here.
And secondly, the secondly is the you have to enable the promiscuous mode on all interfaces as soon
as you can see here.
Right.
So you can also we have update output options and we have your address of our Ethernet network and interfaces
and so on.
So as you can see here, we can also, as I said, firstly, you should make sure that this promiscuous
is checked.
So after choosing an interface to listen on and placing it in promiscuous mode, the interface gathers
up the new traffic like a double click on your face.
And here, as you can see here, my interface is gathering new traffic.
So if I if I go to some website like Oxley oxley.com, it will send us a bunch of um, requests and
signals.
Right.
So.
Here.
This is our website also.
So part of the effect of capturing traffic is having an appropriate package, capture pcap engine installed
and the Pcap engine provides an application programming interface API that.
After traffic from the network so that it can be processed by operating system.
In this case, we will not install that for now.
And first, let's learn about how to decode bits in Wireshark, which you will learn in next lecture.