Welcome back everyone.
Let's do a quick dumb one Wireshark and see how exactly wireshark captures Bakhit so you can go to start
tightwads shark can right click on it and we can open it doesn't diminish.
We can guess.
The UI LOTES and you can see all the capturing interfaces d'Agde wireshark was able to figure it out.
If you see on the local area or correction that's where the traffic is currently flowing from my virtual
machine on going all the way out to my internet to the internet so I can just double click on it and
it will start capturing the packets for me.
You'll see that a bunch of activity going on there is some Microsoft Update activities going on as well
which aren't captured.
Let's go to Chrome and just with it any web site and come back to our shark and see a bunch of DNS requests
and a lot of other Internet activity when you will launch wireshark you will see that it's capturing
a lot of traffic so your machine is constantly doing some the other network activity like operating
system updates some application trying to update itself all your browser is trying to update the add
on or trying to make some connection to check if there are new words it's available and things like
that.
So Warszawa will constantly capture a lot of information once you started.
Let's wait for a while so that we have enough graphic capture and once we are done with capturing we
can click on stop and Dave Packard Gotcher will stop down let us come to the display filter that we
talked about in previous few videos.
So to begin with let's just look at all the DNS requests that were made.
So if you can see here we have a request to Microsoft we have requests to Google.
We have a request to read if that was the one that was made to our browser.
And if you keep scrolling down you'll notice a lot of different requests.
For example Rediff tried to launch e-mails it launched some ads went to bookstore to dot com and so
on.
So that's all the DNS requests that was captured by wireshark while the session was active.
Similarly we can go to should be requests press enter and it will give us all the authority to request
that were made during the session.
You can see that was a Microsoft update request.
Then there were a few more it should be a request made directly to a page in.
There are some chrome browser requests then drif makes some specific requests.
So these are usually the subsidiary redirects that a web site does.
Once you make a request the Web site for example we type really dot com but really dot com in internally
called a lot of different websites.
For example if you look here that is a get request that was made to an image.
So this image might be there on the page.
And if trying to fetch an image from it's from somewhere and that's why I get Scatchard as a get request.
So this is how you can look at all the GDP packets.
You can also look at all the DCP backorders similarly and curial get much more details about the DCP
data or that when in and out.
So if you look here this is the first get request back to the page to read if dotcom using our web browser.
Now the 3 DCP requests right above it are pretty interesting if you look at the first one you'll see
that it's a sin request that went from your machine to the server.
Then there is a sin packet which was sent by the server back to your machine.
And finally there was an AC kit package which was sent from you to the particular server.
So what exactly this is if you guessed correctly this is the PC Trivett handshake.
It's basically a method used in DCP IP networks to create a connection between a local host and a server.
It's a three step method that requires both declined and servers to exchange sin and get packets before
the actually communication begins.
So once they threeway Hamrick is that sets foot that's when you get a response Orfield get request I'll
create a small exercise on triva handshake for this video so that you can read more about it in much
more details.
So this is how you can basically interact with your or your y y Sharkey Y and you can understand what
is actually going on inside your network.
Scrolling down here if you look down.
You have the transmission that DCP control protocols details.
So you have this source for the destination for it then you'll have source IP you'll have destination
IP you'll have all different flags you'll have options you have sequence and analysis.
So these are not.
But all the different headers that constitute APCP packet.
So if you read about VCP or if you'd read about PSAP Hellers these are the fields that you are going
to see in that you will see source for the destination board you'll have information about sequence
numbers.
So what sequence number tells you is if Bakare transmits.
And if it gets divided into different chunks then they will all have different sequence numbers so this
is what the sequence number that contains that information for you.
So let's try something else.
For example if let's say we want to see all the get request they get strictly be requests that were
made from this machine.
So we type DCP contains the kit and we'll press enter.
So this is a string match.
We save that give me all the VCP packet that contains get in it.
So this is where we get all the get requests that are made to our machine.
Similarly if let's say you want to know about the traffic going in and out to a specific IP address.
For example let's say 20 3.6 dog one by 9 or 10 and you can type your idea or 80 are equals 23 dot 6
dot 1 9 9 or 10.
You can press enter and you get everything figured out based on the IP address.
So this is how display filters help you in narrowing down your traffic to look for specific information
or to look for a specific package that can help you in answering the questions in much more detail.
So this was a quick demo about white shark.
That's it for this video.
Thanks a lot.