Pockets and network traffic.
Hello, everyone.
Today, we're going to dig a little bit more into the Wireshark, too, and talk about the possibilities
for assessing the traffic that you have when using the tool.
Let's actually go to the end zero and see everything we get there.
So you can see that here we have a few protocols and they continue updating and you can see that there
are different towers for some of them.
So this is a network traffic in the network traffic basically is the amount of packets that are moving
across our network.
So usually we can see that the traffic volume is equal to the traffic intensity rate multiplied by the
time.
So if we want to estimate the traffic volume for, let's say, one hour, this will be the traffic intensity
rate multiplied by one hour or the packet that we receive per hour.
So you can see here that for every packet there are several pieces of information.
So here we see the time over the time at which the packets are captured.
Then we see the source or from where the packet originates.
Then we see the destination, which defines the place that the packet routes is final location, then
the protocol or the type of type that the packets follow during the journey from the source to the destination.
And you can see that there are many different protocols here.
And then you have the information about the packet, which is some additional notes for you to read
if you want to assess it.
Now, information or symbols for capturing files, you can actually assess on Wickett Dot Wireshark
with a dog sample capturers.
And you can read through these bullets here.
If you want to dig a little bit more into the Wireshark tool, I advise you to investigate some of the
protocols, especially the most famous one.
For example, if we search here for HTP and they select this protocol, you can actually find different
files that contain HTP requests in response for you to test the HTP traffic on your device.
Now, let's talk about the powers in the Wireshark tool, because now you can see here different powers
that you might not be clear exactly what they mean, you know, so let's look at them and let's try
to explain them.
So when you're capturing packets, Wireshark is usually using powers to identify different types of
traffic that occur.
So if I double click here, you can see all the information about the specific packet available in front
of you.
And also, if I go to view and then they go to coerce or cowering rules, you can see all the current
rules that are available here.
And you can see that, for example, if we are getting the bad TCAP protocol, it's going to be displayed
like this with this bluish green color with the red.
Then the state change might be displayed in orange, which is usually a word in color.
And you can see also the rest of the colors.
So if we get into any of those states, we're going to get the specific color that refers to that state
you can obviously take.
And until these boxes, if you would like to see this war and incourt display over the certain connections
that are in certain states.
So, for example, if we remove the tick here from the bed TCAP, it will actually be removed from our
screens and you will not be able to see if there is a better DP.
So also, as you can see, guys here, USMA system keep updating and updating and new connections are
received.
You can see that the list of connections is actually going quite a bit like we have plenty of connections
and trust me, there are a number will increase over time for that reason.
It is a very good idea to use filters here in order to find the desired connection that you need in
order for you to do your job and to find the exact connection that you require for your tasks.
So with the search, it allows you to see the data collection only that fits to your search criteria.
Actually, the search criteria is supported by the library called records here.
It's called the Leap B cap.
And this is in the library in the background that works with your search.
And for that reason, for example, for ITC, you can see the different parameters from this library
research protocol.
You can see them here and for.
If you search for a protocol, for example, the DNS protocol, if we search for it, you can see that
it filters only the traffic that is coming from the DNS.
You can also click on different types such as the analyzed type.
And you can see here we have the display filter display macros so we can also use macros here.
We can apply different filters and so on.
We have plenty of options here, but if we select the display filters, you can actually see the display
filters that you can apply when you're a kid during packets with water.
So this is really the main filter that you can use pretty much.
For example, if you want the issue to be traffic, obviously you can use the HTP filter in here.
You can simply see the name and then you can see the filter here.
So let's check the APIs that are with the expression IPV six so far.
Right, IPV six.
You can see all the traffic that is coming from the IPV six and so on.
So use the filters and investigate them.
You can also do this from the Wireshark website.
So they're quite useful, especially if you want to find Veera among many different traffic election
messages.
So which is good to know that you can actually filter your connections or packets by different criteria.
For example, you can use the HTP filter by typing HTP, not content type, and you can actually search
for the type of different content of the website or you can search for the full address on that website.
For example, Charite htp dot location to you can see that here is the screen so you can pretty much
filter here by location.
So that was everything that we wanted to cover about for this to please use in your favor in order to
analyze the different connections.
So that was everything for this picture.
In the next one, we're going to talk about Bizshark.
Thanks for watching.