So in typical traffic capturing on a network interface, there are a lot of packets received from and
delivered to all over the network and well, the internet as well.
So let's see how we can take a picture of that network.
Let's go to Cali and start Wireshark.
You can start Wireshark from the applications menu or open a terminal window and type Wireshark to start
the app.
Don't worry about the ampersand and the end of the command.
Putting an ampersand at the end of the command causes the shell to run the process in the background.
It's sort of multitasking.
You can have many processes running, but only one in the foreground at any given point.
The process in the foreground is the process that appears to have locked up the terminal, whatever
the first message is, because we are a superuser on Kali.
No worries.
Okay.
The welcome page of Wireshark asks which interface we would like to listen to first.
So let's have a look at the interfaces of our system.
To look at the interfaces and to remember the IP address of Kali.
Open a terminal and type ifconfig.
There are two result sets of the ifconfig command eth0 and l o.
Eth0 is the first Ethernet interface.
Additional Ethernet interfaces would be named Eith one, E two, etcetera.
Here we have only one.
Now L0 is the loopback interface.
This is a special network interface that the system uses to communicate with itself.
E0 is the interface that we're interested in at the moment.
Double click to open the Eth0 on the main page of Wireshark to start capturing the packets passing through
our Ethernet interface.
Now to speed it up, let's create some network traffic.
Open one of my virtual machines, Owasp, BWA and Ping Kali.
To stop ping command press control c if config to learn the IP address of the machine.
Now I go to another VM metasploit and ping the last VM.
First.
And then Pinkel.
Here we have a lot of ICMP and ARP traffic at the moment.
So let's generate some traffic.
I open the browser in Cali and visit the website served by the Owasp BWA machine.
And even more traffic.
I visit nhs.uk.
My favourite website.
Okay, that's enough.
Let's turn back to Wireshark.
As you see, we have a lot of packets captured and new packets arrive every second.
ARP Packets.
TCP packets.
TLS packets for https traffic.
ET cetera.
Here we don't investigate the packets in detail.
We want to learn about the systems which are interacting with us.
So go to Statistics menu and select conversations.
There are five tabs in the conversation window by default.
And we're on the IPV four tab at the moment here.
There are IP packets grouped by address A and address B and each line we see how many packets sent up
to now total size of the packets in bytes, number in size of the packets from A to B and from B to
A, etcetera.
There is traffic between 8.8.8.8 and colleague.
Now I know that 8.8.8.8 is the IP address of Google DNS, so I must have set the Google DNS as the DNS
of my colleague.
You know, I'd like to look at the network config.
And yes, my DNS address is 8.8.8.8.
The Ethernet tab, we can see the Mac addresses of the systems.
The address is full of FS, meaning that the packet is broadcasted.
ARP requests are the examples for these kind of packets.
In the TCP tab, we can see TCP packets grouped by the addresses and this time by ports as well.
Because a system may have different interactions with any other system.
For example, Collie may have Http traffic through Port 80 and at the same time it may have an SSH connection
through 22 as well.
Same as TCP packets are grouped by IPS and ports in the UDP tab.
Here.
We have learned a lot of live systems, IP addresses and Mac addresses just listening to the traffic
go through our network interface.
If you'd like to investigate the traffic between the two machines, select the line right click.
If you choose, apply as filter from the menu, only these kinds of packets will be seen in Wireshark.
I'll choose find at this time.
As you see, automatic query string is prepared.
I can navigate between the packets by clicking the find button.
Go back to the conversation window.
At the bottom right there is a conversation types button.
When you click on it, a lot of different protocols are listed.
The selected five are the default selected protocols.
You can add any protocol from the list.
When you select one of them, a new tab is added to the conversation window.