Okay.
Welcome.
Today we are going to play around with Wireshark.
Now we can literally spend 80 to 120 hours, even two months working specifically on Wireshark so that
you could understand all the ins and outs of become a true expert at it.
However, for CSA, you don't need to be an expert, you just need to basically understand how to read
Wireshark and not even that much of an in-depth level, as much as understanding what you're looking
at.
So we're going to do a basic setup for Wireshark.
I'm going to show you some key features, and then I'm going to show you how to read some of the information.
And that's pretty much it.
So it should take about ten minutes.
Very high level overview of what Sha Shark is and everything that's associated with it.
So let's dive into it.
The very first thing I need to do is actually open up Wireshark.
I'm going to open up my terminal and blow that up so you can see it.
And I'm just going to type in Wireshark just like that.
Now Wireshark, because it's operating on my VirtualBox.
Uh, it doesn't have any traffic going through it right now.
There's nothing going in or out of it, which means you can't really see the line.
So let's put some traffic on Wireshark.
I'm going to open up a new terminal.
I'm just going to do an nmap.
I already got one running in the background.
So I'm just going to do an nmap to that one.
If you can't see it here you can.
We've already identified that capture one is on 10.0.2.11.
I'm going to run that and we should see some traffic now on Wireshark.
Now I've got Ethernet zero which is the main traffic line coming into it.
I've also got any.
Now I would recommend that you utilize the any.
When we're going through Wireshark in a lab environment.
That's what we're going to do today.
If you have or if you're using Wireshark for a specific purpose, then identifying the exact port in
which the traffic is coming on is probably better.
But for today's purposes, we're just going to do any you can see here.
Again, no traffic coming through Uh, we have our number, right?
We just had a spurt of traffic.
Come in.
We've got our number.
That is the traffic that's currently processing on there.
The time.
That is the time since we started Wireshark.
That means this is the very first packet from this point forward is going to count where each traffic
comes after that.
For instance, from packet one which was 0000 to packet number two was 0.014 seconds after the first
packet came in.
And point or packet number three or number three was 0.075 or excuse me, 5.075 seconds after the first
packet came in.
And you can kind of go through and see that as it goes through.
Right.
We have our source IP.
That's the IP address that it came from.
You have to realize that Wireshark is looking at traffic both from a from and then to a two, which
means that if I pull up miss paint, if you look at Wireshark and we have two computers, we have computer
A and we have computer B right here.
Now between the two we have traffic.
That goes both ways.
Wireshark looks at it not like this but like this.
There are two different strains of traffic, meaning that traffic is either going from B to A or from
A to B, and it emphasizes that in the way that it processes information.
So in this context we have source right.
10.029 that's traffic coming from there.
From the source IP address of 2.9 to the destination IP address of 2.3.
When it reverts back, it's providing or when 2.3 responds, I should say when 2.9 responds, I cannot
talk today.
Uh, we're saying from 2.3 to 2.9.
So for instance, traffic is going from 2.92 to 2.3 and then from 2.3 to 2.9.
And we're kind of sitting in the middle looking at both traffic lanes.
And that's what we're doing today, right.
So those are our source and destination IP addresses.
And then we have our protocol.
What protocol is it operating on.
In this case for one and two it's DHCP for lines three and four or for packets three and four it is
on ARP Address Resolution Protocol.
Then we can see the length.
That's the length of traffic that's going through.
And then a basic informational, uh, of what's going on.
Right.
This is very, very basic.
Right.
For instance, on number three we can see that it's saying who has 2.3.
And it's going to tell 2.9.
That's what it's doing.
So let's provide some context to this.
Well first let's set this up right.
Uh for basic setup for Wireshark especially the first time you're using it, I like to add my source
port and my destination.
Now I can find that information right here under User Datagram Protocol.
It tells me that the source port is 68 and the destination port is 67.
But I want to view it up here.
To do that, I'm going to right click anywhere on this bar and I'm going to do column preferences.
Under Column Preferences on the right hand side we can add columns.
I'm going to push that plus sign twice.
And you can see that it added two columns for me right here and right here I'm going to put the first
one just double left click.
And I'm just going to put SK port enter.
And then for the next one I'm just going to double click and put DSC port right there.
So now I've got my source port and destination port.
But I need to tie it in.
So for my source port I'm going to double click again.
And I'm going to drag it down to source port resolved right here.
Source port resolved.
And for my destination port again I'm going to put destination port resolved.
I press okay.
And then you can't see it yet, but it's all the way on the right hand side.
So I'm going to grab that.
I'm going to move it over to the source port, and then I'm going to grab the other one and move that
over to the destination.
So now if I look at this, I've got time source and then source port and destination, and then destination
port.
If the numbers don't add up or the columns are too small or whatnot, you can just double click and
it'll fix that for you so that you can actually read it.
Now, I would recommend expanding your destination out a little bit, because you may find out that
it's not enough space.
So let's dive into this a little bit.
Let me do a basic internet search.
Let's go into Firefox real quick and let's just go into Google.
I'm just going to hit Google.
That's it.
And I'm going to go back into Wireshark and look at all the traffic that's associated with it.
Look at all that juicy traffic.
All right.
Let's say that I wanted to look at a specific IP address.
Let's say I wanted to look at 2.9.
Like 2.9 is something I wanted to see.
I could do IP and then just by typing IP, it's got all these little shortcuts that I could do.
I could do destination, which means if I click on that and press enter, it's only going to show me,
uh, traffic that is going to IP address 2.11, which there is none.
Right now.
But what if I did address?
Let me throw that equal sign back in there and hit enter.
And you can see that IP address 2.11.
We're not seeing any traffic.
What about nine.
What if we did nine.
There we go.
That means that it's going to show all traffic going into IP address 2.9.
Now I did to a lot of it because I've got catfish running in the background and I forgot to ping it.
But that's okay.
That's great.
Let's do that now.
Let's let's jump into this.
We can see here that I've got 211.
Let's just hit a ping 10.0.2. 11.
Just like that.
It's going to start pinging it and go back into here.
And then I can do 11.
But instead of doing IP address let's do destination.
So I'm going to do IP and then DST.
And now it's providing me all that juicy information.
Right.
So we're doing a ping against 211.
And it's providing that information okay.
If I stop that Press Ctrl C to stop that.
It should stop traffic on there.
Now, this entire time I've actually been capturing this data, I've been saving this data.
And I go to file and then I can do a save.
Well, I have to stop it first, but I have to stop the traffic.
Then I can do a file and then save.
And I can save this as a pcap file.
And you can see here Wireshark pcap.
I'm not going to do that right now, but just realize that is how you get a pcap file.
Okay, so I've got all this information.
Let's say that I wanted to get back to the original information.
I could literally just delete all this right there.
Hit enter and now I'm back at where I originally was.
Okay.
You can see here that the eight isn't actually accurate.
If I click on that now, you can see that I'm actually in the inner range.
And if I scroll all the way down and just that a little bit of traffic that I've done is that little
bit of traffic you can see here that I am quite high on the traffic, around 904 packets already.
Okay.
So this is Wireshark very high level.
Let's dive into this context here.
Let me find a good one.
Here's a basic traffic right.
This first one is going to provide us the frames.
Now this goes a lot off the OSI model if you remember that.
So here's our IPS.
Our internet protocol version.
And we can dive into this.
We can see our destination source IP addresses.
I can expand these and go into different services.
I can go through here and provide that.
We can see the time to live for 255.
We can see our protocol is TCP.
We can see our chat or checksum validation is disabled but we see a checksum.
I can expand our transmission for protocol.
Let me, uh, reduce this.
There we go.
And this TCP provides us with our source port is if it's not available up here, we can see the destination
port 40,134.
Our stream index.
And we can go through and really start to see this.
We can also see our timestamps both from the perspective of time since first TCP stream or in this TCP
stream, and then time sense this and PVC stream.
We can also do a sequence analysis and we see that information.
Uh, this is the basics of Wireshark very high level.
Uh, very much something that you should understand the basic principles of.
Now see why I say doesn't go into that much depth with Wireshark.
It does expect you to understand what an echo and a ping is.
It basically understands how Wireshark works.
You should understand the basic principles of Wireshark as far as CBC is explained.
Don't expect some in-depth questions on there.
Don't expect that.
Ask you specifically, how do you use Wireshark or the different filters?
They might provide you a different context of this, of a little screenshot of Wireshark, and expect
you to understand how to read it, but I wouldn't expect to see anything much more in depth with that.
Uh, very quick overview of Wireshark.
I hope this was helpful.
We will see you in our next, uh showcase.
Talk to you later.