Wireshark is free, open source and the world's foremost network packett analyzer, and it is the de
facto standard across system and network administrators.
Wireshark has the ability to listen and record traffic, as well as advance filtering and reviewing
options.
We're not going to do a deep dive into Wireshark right now, since that's the subject of network layer
attacks, which is, of course, it's coming soon.
So here, let's let's see a summary of the traffic and the systems related to the interfaces.
We listen.
Let's go to Cali and start Wireshark.
You can start Wireshark from the applications menu or open a terminal window and type Wireshark to start
the app.
Don't worry about the ampersand in the end of the command, putting an ampersand at the end of the command.
It causes a shell to run the process in the background.
It's sort of multitasking.
You can have many processes running, but only one in the foreground at any given point.
The process in the foreground is the process that appears to have locked up the terminal.
Whatever the first message is, because we are a super user on collee.
No worries.
OK.
The welcome page of Wireshark asks which interface we would like to listen to first.
So let's have a look at the interfaces of our system.
To look at the interfaces and to remember the IP address of Colly over the terminal and type if config.
There are two ResultSet sets of the Afghan fingerman, either zero and L oh.
Ethe Zero is the first Ethernet interface.
Additional Ethernet interfaces would be named ethe one, ethe two, et cetera.
Year we have only one.
Now, L o is the loop back interface.
This is a special network interface that the system uses to communicate with itself.
E0 is the interface that we're interested in at the moment.
Double click two over the ethe zero on the main page of Wireshark to start capturing the packets, passing
through our Ethernet interface.
Now to speed it up.
Let's create some network traffic.
Open one of my virtual machines, A, WASP, B, W.A. and Ping Colly.
To stop Pink Command, press control, see if config to learn the IP address of the machine.
Now I go to another VM Meadows, Bloy and Ping the last VM first.
And then Ping Colly.
Here we have a lot of ICMP and art traffic at the moment.
So let's generate some traffic.
I open the browser and collee and visit the Web site served by the Owais B.W., a machine.
And even more traffic, I visit NHS, Dot UK.
My favorite Web site.
OK, that's enough.
Let's turn back to Wireshark.
As you see, we have a lot of packet's captured and new package arrive every second hour, packet's,
TCAP packets, deal less packets for HDD, P.S. traffic, et cetera.
Here, we don't investigate the packets in detail.
We want to learn about the systems which are interacting with us to go to statistics menu and select
conversations.
There are five tabs in a conversation window by default.
And we're on the IPV for tab at the moment here, there are IP packets grouped by Address A and address
B in each line we see how many packets sent up to now total size of the packets in byte number and size
of packets from A to B and from BDK, et cetera.
There is traffic between eight eight eight eight eight eight and my colleague.
Now, I know that eight eight eight eight eight is the IP address of Google VNS, so I must have set
the Google DNS as the DNS of my colleague.
You know, I'd like to look at the network config.
And yes, my DNS address is eight eight eight eight eight.
Got a.
In the Ethernet tab, we can see the Mac addresses of the systems.
The address is full of F's mean that the packet is broadcasted, AAP requests or the examples for these
kind of packets.
In the DCP tab, we can see TCAP packets grouped by the addresses.
And this time by ports as well.
Because the system may have different interactions with any other system.
For example, Colly may have HTP traffic through Port 80.
And at the same time, it may have an SS age connection through 22 as well.
Same as TCAP packets are grouped by IPD airports in the UDP tab.
Here we have learned a lot of live systems, IP addresses and Mac addresses.
Just listening to the traffic go through our network interface.
If you'd like to investigate the traffic between the two machines, select the line right click if you
choose, apply as filter from the menu.
Only these kinds of packets will be seen in Wireshark.
I'll choose find at this time.
As you see, automatic query string is prepared.
I can navigate between the packets by clicking the find button.
Go back to the conversation window at the bottom right.
There is a conversation type's button when you click on it.
A lot of different protocols are listed.
These selected five are the default selected protocols.
You can add any protocol from the list when you select one of them.
A new tab is added to the conversation window.