Hi, and welcome back to Session two Network Fundamentals.
In this video, we are going to see an introduction to Wild Sharkk,
while sharkk is a network protocol analyzer.
And we saw in the last video that network communications are defined by
protocols to communicate between systems and a logical grouping of
protocols that work together is called a protocol stack.
In protocol analysis,
we can describe structure and inter live data
as it flows across a network to better understand what is happening on
the network. Protocol analysis can help with understand network characters
learning, who is on a network,
determining who or what is utilizing available
bandwidth, identify peak network usage times,
identify malicious activity,
and finding unsecured and broader applications.
When we are using Product Analyzer,
we can evaluate this tool with some properties of IT
supported protocols, user friendliness,
cost program support, source code access,
and OSS support. At the high level,
a protocol analyzer works by starting first in a collection
that's mean it collects raw binary data in a network interface
in promiscuous mode. Then these two,
two works in convention in capturing binary data to
a readable form. And finally,
it's possible to analyze the protocols while Sharkk is present
in many cybersecurity distribution like Call,
Linux and Perot OS for a clean installation.
Wireshark is available@wireshark.org and he's
available for Microsoft Windows and Micro S
two. So let's start here.
I'm using a Calli Linux environment and, uh,
the wire track is already solid in this environment, this machine,
and is available in my start menu.
And this is our initial interface windows in the interface of
Wireshark.
What we are seeing here is a list of all my network interfaces,
uh, available for me. So we have a real, uh, interface here.
A physical interface here is some visual interface available here.
In this graph here is showing all the live packing package,
uh, traffic, and by my,
that are passing through my network interface here and may
not double click is if I put the mouse here, uh,
to tip will show my IP version four and version
six. And for start a live capturing package,
I will do a double click in my network interface here.
So what we're seeing here is a live cap about all the protocols that
are passing through this interface here.
So we have some, some protocols here.
If I open a web browser and start to, to assess some links
like this,
you're gonna see that
more package are tracking about this network here.
So this tool Bar Shark is responsible for this,
for capturing all the package that are drafting in this in the, in my network,
in my, uh, interface, network interface. Uh,
we have here three three panels.
So the first one is to show all the, the,
the package with some information about the number of the package,
uh, the time, the source, the source and the destination,
the type of protocol.
The length of this package is some additional information that, uh,
wire shark is providing when get this package.
The second panel here is about the details is, uh,
packet details to show the layers for each
package. We're gonna see in the next video about the network layer,
and every package belongs from one
specific uh, layer. Okay,
this package passed through some layers and this is what we are
seeing here this moment. So in the next video,
we're gonna see more details about this, but for every different package,
the number of layers passed from this package could
change is the end of the, the, the package.
Every package belongs from a specific layer.
And the last panel here is about the package bites.
That's mean is a, is a raw information in, uh, for odax more,
uh, bytes.
So it's useful when we are seeing some specific information
about, about this package.
The next information here is about the,
the color that we are seeing here. So, uh,
for every package we have a different context and we,
we can change the color to help through our analysis.
And this is a custom, uh, configuration.
So we're going see here in view menu
coloring rules,
and here we have a list of some package and some filters.
We are gonna see that, uh,
wire shark is very powerful about the filters that we can use
for our analysis package analysis. Uh, and this we have, uh, the full,
uh, color rule already.
So for every color here, we have specific rule.
For example, for D C P and U D P,
we have a different colors here for H T T P protocol for the
Port 80, for example, we have a different color for our protocol.
For example, this rule here for BET C P, we have, uh,
a conditional filter and we have some elements here from, for example,
flags analyze for T C P, uh, windows update, window update.
Uh,
so we is a filter is a logical condition that we can
use. We can use a direct condition like this, or we can use, um,
multiple logical conditions with some, uh, conditional, uh,
options and, or, or for example.
And this is a powerful option to create strong
filters and help in our analysis. Next,
for all this package collecting,
we have our option to save and support
this capture package. So we,
we have to stop the live filtering capturing here,
and we have some specific options to save.
The format is PC pickup energy,
but we have some other different options here to,
to use in others, uh, tools.
So is very, uh,
powerful with this a kind of integration about all the
information that we capture,
or we can use our option to export for specific, uh, format.
For example, we have this, uh, spark packet section here.
So we can export this format for a JS O, for example,
or a C V Ss or a plain text.
So this is a part of your configuration and option here.
Or we can export for a packet bite, for example. So this is very,
uh, interesting to get more information to, can add the tail,
a condition, for example, to use in another, uh, format or in another,
another tool, finalize this package.
Another very interesting option that we have here is about the collecting
package. When the time of the reference,
the reference time for each package, for example,
here we begin in the time zero and every next
package that Wireshark is getting has this
reference time here for the first package here.
So this the first one and the last one is the time, uh,
passing from this first one.
But we can change this in view time from a display
we have here, uh, some options, so automatic from capital five, for example,
and the second, since beginning of capture was the information that,
that I said before. But we can change, for example, for the daytime, uh,
for the universal daytime or the daytime present now.
So we have some, uh, uh, configurations here,
some options available here to help our analysis.
So it depend of your option if for, uh, uh,
get a different reference time. So the,
the full option is very interesting because we are analyzing and
we have like a timeline since the first package that start the,
the first package. So this is the, the full, uh,
configuration for time slice.
The next very interesting option here available in,
in Shart is about the futures.
The future is a strong feature present in this tool
depending on the, the type of filter that you use.
This is help you a lot to get, uh,
more formation about this analysis that you are doing in the,
in the protocols. So in Wireshark we have two types of filters.
First one is about a display filter.
That's mean that in this bar here, uh, we,
we can use a lot of different filters.
We can type in filters here or we can use this button here
and, uh, start to write, uh, more details filter.
But a first uh,
way to put a filter is type here directly in this, in this part. For example,
we saw that we have a lot of package here,
more than 7,000 package here.
So this is confusing if, for example,
if you want to get a specific package to avoid this.
For example, we are looking for H T T P protocols here.
We can filter here in H T T P, uh, the,
the background color change. That's mean that, okay,
this filter is we have package, we have,
uh, a result for this filter. If I
put enter example,
I have a filter only for this kind of protocols. For example,
if I have T C p,
I have T C P only T C P for this filter here,
for example, D C P and, and some protocol related for this.
So this is a display filter.
Other option here is when we start to
create a new kind of capture, for example,
here I have a capture filter.
That's mean that our shark will,
will capture only this kind of protocol.
They're gonna use this filter as, uh, uh,
input when we are doing a live capturing. So for example,
if I want to capture only T C P protocols,
I put this, this information here in capital filter box, I select
my interface and start.
So, and I will start a browser, for example,
and start and look.
The wire sh will capture only T C P filter TCP protocols.
So this could be more
interesting about kinds of, uh, resource.
I'm not looking for every kind of package, for example, and collecting.
I'm only looking for a specific package.
Next, another very interesting, uh,
options that we have here.
Features that we have here in arch is about to see all the
communication, all the conversation between the machines,
the nodes, because in the network,
we saw in the last videos that in the the network communication,
we are talking about one machine or one node talking with another
machine. Okay?
So one device is connecting to one to another device
or multiple devices to get some information to exchange some
information. Information. So for this,
we have some interesting options here to,
to solve and to understand all this communication.
So let's start a new life capturing here,
the ethernet interface here and start.
Okay, so we are capturing all the, the,
the information of the package here, let me open a,
a browser, okay? And we have a lot of package
and, uh, let's start to see the, the endpoint here.
So we have
features to solve the endpoint. So that's mean that all the devices,
our list of devices in this capturing and a conversation
flow. So let's start with end points.
So this interface here is showing about, uh,
some package. For example, if I select the
IP four, uh,
the wire chart will give me a list of all the devices, all, all the,
any points that was participating of the,
the capturing that that we did. For example, here we have some ips,
we have some local ips here about my network here.
And for example,
for this device that has this IP here,
we,
this device are exchanged 25 at is moment
25 package. The number of bytes,
the bytes that was exchanging and if wire shark
could be able to translate some formation to get the counter ct.
For example, if I change for D C P, it's the same. So
this device here has exchange. Some package is some, uh,
D C P package. Uh, use this port here for example,
and X exchange package mean this bytes for example.
And this is the same for another protocol called E D P, for example.
So this is very powerful because
in this view I'm able to get some informations
about the end points
not referring interesting information about conversation.
That's mean that we have a conversation from one, uh,
device to another device. For example,
at this moment here, I have this one here,
this device here address A, for example,
this device had a communication with address B for this IP.
Here they exchange the number of package, the,
the size of bytes. For example,
from this direction,
package A to B was 54.
This moment we don't have package from the inverse
flow B to a, for example,
the duration and the beat.
So with this veer here,
we are able to identify the conversations between the, the devices.
And this is very interesting because imagine that the,
your machine is sending information from unknown
ip, for example. So in this view here, we gonna see this,
we are gonna say, hey, we have some, uh, some conversation, some exchange,
and we have a list of unknown ips, for example.
So this interesting to start, uh,
an investigation more further. For,
for one case. For example,
a great feature present in the wire shark is about following
streams.
So wire sharkk is able to resemble data from multiple package into a
consolidate format called a packet transcript.
So that's mean that between all the communications, uh,
and all the,
the package that wack is able to capture wack is,
uh, able to get the flow for some package
and reassemble to give you
a logical flow, a logical, uh, stream
for the communication, uh, between the devices,
the networks. So for example,
let's open a web browser here and let access,
for example, this, this website here. Okay,
so now let's put a filter for H T P and we have
some filters here. And now we have this option for follow.
So for this package is able to follow T C P
or follow our H T T P for in HTT p here
we have different colors. The first one
was from my device here, and the,
the blue here was the, the result. So for example,
I have the start communication here. And look, there's, uh, a flow
for, for example here we start and we have have the, the result here.
So the red, uh, option here,
the red result here is about the flow that start from my
machine and the, the blue here was the result.
So when this option here is able to get
a flow and we can understand all the exchange of,
of information. So let, let's put here another,
not a filter. For T C P for example,
I would choose a random, uh,
package and put a follow for T C P and was the same.
We have the workflow look for the, the,
the link that we asked us.
So this start from my device
and this was the result that I received it from the,
from the server. So
this is interesting to, to get the, to understand the flow.
So we have to choose some package to get
the, to understand the,
the information that we are receiving here.
But with this information here is able,
we are able to understand all this kind of
exchange. So we have some, some package
and we have, uh, this option to,
for every package get the,
the flow this package to another one.
So to understand all the, the information we have to choose some, uh,
specific package and, uh,
assemble this information to get all the, all the information.
P c p,
we don't have nothing for DL to D L Ss,
but that's it.
In this video we saw an introduction to Wireshark and we
saw you some features present in this tool.
The next video, we'll take a look at the network OZY model.
So I hope to see you, to see you there.