[AUDIO LOGO]
Welcome back.
In this lab, we're going to dig into TShark.
It is the command line version of Wireshark.
And it'll be really fun to get used to.
We're in our interface, and the first thing
that we want to take a look at is, what version of TShark
do we have?
It's pretty easy.
The command is tshark, and we'll look at tack v for Version.
Another way we go about that is tack h or minus h, if you will.
And what that will bring up is the Help menu.
Now, this is going to be an eyesore.
Sorry.
There's quite a lot in this whole menu.
So what we'll do is we'll pipe that to more.
And then, we get one page at a time.
So you have the version up there--
2.61-- and then some information.
If we want to capture with TShark, we can use tack i
and pick an interface.
Tack d there will print a list of interfaces and exit.
That can be quite useful.
We'll take a look at that.
There's also, we could take an input from a file, tack r.
So if we had saved a PCAP or a PCAP NG,
we can look at it with that tack r.
So let's see what else.
There's more processing.
There's some outputs that we can choose.
There's a tack v in there in the outputs,
so you can output a tree.
You can do tack z.
There's different types of statistics,
and we could see that if we go into the man page.
For example, you would man tshark.
That should have done it.
We'll just play with what we have.
So let's look at what interfaces can we interact on.
So tack d gives us a nice list.
We have eth0 listed in there.
So let's take a look at that one.
Let's do tshark tack i eth0.
And unfortunately, we are not on the sudoers,
and we're not sudo or root.
So we don't have authorization to actually run
a dump on that interface.
Instead, what we can do is we have a PCAP.
So let's run tshark tack r on that PCAP,
and then this is going to hurt.
So the screen is going to scroll and go
through all of this packet capture.
There's a lot.
There's a lot going on there.
We're already looking at tens and 20s of thousands of PCAPs--
30,418 packets or frames.
It's a lot in there.
That you might be wondering, how do we sort through this?
How do we do anything with this knowing
that there's so much out there?
Let's do a word count just to confirm.
Yep, 30,418 lines-- so a lot going on.
We're not going to go through this the same way
that we did with Wireshark, where we have the graphical,
and you go through and look at different packets.
This is going to be more for targeted analysis.
If you are looking for something specific,
you want to pull that information out, turn it
into something else.
This is for processing when you already know what you're doing,
what you're looking for.
It's a little more in-depth, a little more targeted,
a little faster.
And when you get this stuff working properly,
you can script it, include it in tools,
and then you don't even have to manually do it yourself.
You do a capture, you run your tool against it,
and it finds the information that you want.
You can't really set that up in the GUI version.
GUI version is great for looking and moving around.
But TShark allows you to do a lot more of this stuff
automated.
Automation is awesome.
No matter what you're doing in security,
but if you're a pen tester and you can automate things,
so you don't have to do it over and over and over again
or pull out the useful information,
plug it into me, so I can then put that on my notes
and then get moving with the rest of your pen test.
You've only got so long on during your assessment,
so you need to make good time of that.
So this can be really helpful when you have it down.
Let's look at this information, and let's run some statistics
on it.
So we had the ability to do our hierarchy
before in Wireshark in the GUI.
We can do that.
We can do a protocol hierarchy here with this tack z
for statistics and then, io,phs is going to give us
our hierarchy along with the tack q.
So these are what we would be used to seeing.
So how many of these frames are of different types?
There's PNGs.
There's all sorts of different media in here.
Only six of them are actually HTTP frames,
and you gets some ARP.
Now, this is not a really crazy lesson.
I just wanted to show you what the tool can do,
a little bit of what you might expect from it.
And hopefully, you got something helpful out of this.
We're going to dive a little deeper,
use a little more analysis because what you can get out
of looking at traffic and what you can use it
for is really the meat and potatoes of this course
and what I want you to take away from it all.
Now, with that--