In this lecture, I'll show you how to use Wireshark to sniff and analyze network because it captures
back in real time and to displace them in human readable format.
Wireshark includes filters, protocol detectors, color coding and the many other features that let
you dig deep into network traffic and inspect individual packets.
Note that Wireshark is not a hacking tool.
It's used to monitor the interface of your own computer and capture and analyze the traffic that passes
through that interface.
In my opinion, it is the most useful networking tool for learning how networks work and for troubleshooting
network problems.
Of course, this is arguable.
Let's get started.
Why are Sharkey's installed by default on many Linux distributions?
If it's not installed on Ubuntu or other Debian based distributions, you simply install Wireshark by
executing APD, install Wireshark.
For Windows or make you simply download and install the corresponding version, I'm opening Wireshark.
To be able to sniff traffic, you should start it, Hazrat.
To allow not to get users to capture packets, you have to follow a special procedure described in this
official help file.
To start capturing back on an interface, you double click the name of the interface in the capture
section of the main screen.
For example, I want to capture Keeks on ETG zero.
And he kept chugging bakkies.
Let's visit a website.
OK, and you see here all the captured Becket's.
And I'm stopping capturing packets, another way to start capturing packets is to go to capture options,
select the interface, click any other options and start.
In this window, you can enable promiscuous smut on all interfaces or only on a specific interface when
a wired or wireless network Cartesian promiscuous mode, it can read all the received traffic rather
than just packets addressed to it.
At the moment, Wireshark is capturing all the packets received on the interface.
Let's generate some more traffic.
When you want to stop capturing traffic, click the red stop button near the top left corner of the
window.
You can see captured packets highlighted in a variety of different colors, Wireshark uses colors to
help you identify the types of traffic at a glance by default.
Light Purple ECP traffic light blue is UDP traffic and black identifies packets with errors.
To you exactly what the color codes mean, click view and collaging rules.
You can customize and modify the coloring from here, if you like.
Let's have a look at Wireshark main window.
We notice it consists of three main parts.
The packet list pane displays a summary of each packet captured by clicking on a packet in Spain.
You control what is displayed in the other two pens, the packet details.
Spain displays the packet selected in the packet list pane in more detail.
Into the packet by Spain, this place, the data from the packet selected in the packet list pain and
highlights the field selected in the packet detail Spain.
Each line in the Paquita least corresponds to uncaptured ticket, and if you select the line in this
pain, more details will be displayed in the packet details and packet buycks pain.
Now, if you double click a line, a new window pops up with details about that particular packet.
In this example, we are seeing information about the effect of that headers like the source and the
destination.
Mac addresses the IP header.
These are the source and the destination IP addresses.
And finally, information about the DCP header and application data.
This one htp over URLs, by the way.
This is unencrypted packet.
Probably you have noticed that there's a lot of information, but if you want, you can save the capture
for later inspection to save the capture to a file you press on control plus like this or go to file
and then save or save this.
Wireshark can save the packet data in more than one format.
You should choose the correct format depending on how you want to open the file.
Later, other network analyzers use of their own format.
The most important for marks are be QEP Energy, this one, which is the native file format for the
latest version of Wireshark and beat cap format used by older versions of Wireshark, but also by other
well-known and widely used tools like DCP Dump.
Not all information will be saved in a computer file, for example.
Most file formats do not record the number of draft picks and I'm saving the capture is a pick up file.
And by closing Wireshark.
At a later time, you can open the file with Wireshark or with other tools like Tsipi Dump, which is
a command line tool.
This is the file, the peaker profile I've just saved, and I can open it with DCP dump like this.
OK, this is all about the basics of Wireshark, take your time to understand how it works, because
why Korshak is really important for any network engineer in the next lecture will dive deeper into other
advanced features of Wireshark, which are filters.