I'm sure you've heard about the famous wire shark network sniffing talk which is used to understand
protocols debug issues on the network and of course analyzing traffic while shrike uses the libraries
on Linux and Windows cold lippy cap and wimpy cap Linux that could capture and Windows packet capture.
As you might have seen before if you used this tool you will get lots of lots of lots of traffic.
So the secret to effectively use the tool is to use the capture and display filters so before demonstrating
how Web site works.
Let's go back to basics and see how we establish a basic DCP connection.
So actually do when there is communication between the client and a server the client sends a sin packet.
The server replies back with a sin ACH packet.
Then the client confirms back with an AG packet and to hear the connection is established.
So this is a full round of connection.
You might have seen that the server always replies with the sequence number plus one.
Then the client replies will the seek with a previous sequence number plus one.
No need here to go into the details we're just explaining that in order to make an effective use of
the wire shard.
Similarly the same thing goes when we are terminating a connection a three way handshake as well.
So the client sends the server offend back it then the server replies with a thin ACH packet then the
client confirms with an act packet and the connection is terminated.
What we will demonstrate here in the next layer of example is this scenario from our Kelly machine.
We will connect using our previous example then that's cut and we will try to use the previous example
of texting using the chatting between the client and the server then we will fetch the traffic and analyze
the traffic and see what happens.
So here if you want to open while shy you go to on the menu under sniffing and spoofing.
First of all you need to filter the interface that you want to capture traffic on.
You can see here by default you have lots of filters and you capture all the traffic coming on these
filters.
You end up with a huge amount of data and information.
So we are interested in only filtering or using the Wired interface with which is basically the Ethernet
interface.
So after that we press on this start capturing picture.
It is very important to understand the layout of the way and shock it is divided into two four parts.
The lower part here is the network as you can see it's a low level data hex data bits etc. The upper
part here is the capture filter.
So based on the filter that you identified before the capturing is taking place here.
This section here is the captured engine.
It's actually capturing the traffic based on the capture of filters we define for and on top here you
will see the display filters after we stop the packet capturing you will of course end up with a huge
amount of data.
And this is the best way on filtering and querying the data that we will end up with.
Now it's working fine and it's sniffing the traffic.
We will go to the cloud server here that's cat and we will invoke this comment.
So here we will open port to 2 2 2 and we will listen to any traffic coming on board to do 2 2 from
our Kelli machine.
We will open a terminal and we will invoke this command which is then cut then end the option then the
target IP address and then the target port.
Now we were able to establish a connection between Kelly machine and the windows cloud machine.
Remember the chart example we did before.
Let's do it here all over again.
Hello from Kelly and then we go to the machine here.
We will see the text promptly we can reply back and if you go here to the Kelly again we will be able
to see the message.
So a certain activity has been taking place between the client and the server.
Now we can go here to the wires shark and stop the packet capturing this is a small file but in the
real world scenario you might end up with a huge amount of data here.
So these display filters will help us a lot in working with the file.
We can filter based on the source address the destination address the protocol type and the port for
example if you can go to space IP the source and the source here in this case is 2 1 1 the 20 30 and
you press enter.
You'll be able to get this information here.
If you want to search on the destination 1 7 3 0 2 4 8 2 1 3 2 2 Thirty.
Here you go.
As you can see here the data contains our protocol and being as another our protocol then DCP protocol
etc. If you want to filter on the DCP protocol just try to FTC feet and then press enter.
You will see here what happened actually in the previous example the copy machine.
The source IP of 130 initiated in connection with our cloud server here as you can see this is the start
of a three way handshake.
This is the send packet and then the snack packet and then the ACH packet then connection has been established.
If you want you can follow a stream in order to get the cream.
So if you're right click here and then follow DCP stream.
It will actually give us the end result of actually what happened in this connection here.
Now if you start capturing packets again.
Suppose that I don't want to save this and go here to my Kelly machine and stop this connection
I'll stop the traffic again and filter again for DCP you will see the three way handshake for terminating
the connection thin for ag and then the ad packet.