Hello, guys, and welcome to the first video of this chapter.
A lot of times we utilize Wireshark as how it is normally advertised.
Which is, we just fire up Wireshark, which is the interface we would like to capture
the traffic from, and then we just hit start capturing.
So we capture the traffic, we save the
whole traffic in the file, and then we go ahead and apply the display filters
and that we would like to focus upon investigating.
So instead of capturing all the traffic
and a specific network, you might want to focus on capturing some
traffic that is generated by a specific host in this network.
So today in this video, I am going to show you how you going to do that and start
capturing the network traffic of a particular host.
So once you fire up Wireshark, before you begin capturing,
before you choose your network interface, start capturing
so you can let you go first in the capture and capture filters
so we can see all the filters that are available that are available.
And you can choose from.
So this is the name you can create your
own, your new one, but you would like you can give it any name you want and of
course, then apply the filter that you would like to be applied.
In this case, we are going to focus on
capturing the Network traffic of a specific host.
So let us go here and use the already.
The already prepared one, so this is just the name, we
can also change the name and put it whatever we want and then we can just go
ahead and the filter section and just change it.
So we're going to leave the host space and we can change the address.
I've already changed the address for this filter.
I put the.
This is the IP of the system that I'm sitting on right now.
And I would like to capture only capture the traffic from this network.
So you can go ahead and apply all other sorts of filters.
Maybe you would like to capture only the TCP
section, so and so on and so forth, so you can after you modify this filter.
And you change the host to another that
you would like to capture traffic from then hit.
OK, so now you can just go ahead and select your interface.
In this case, I'm going to select mine, which is Wi-fi.
And before you start capturing.
You can just go to this little wheel if you have the same version of
Wireshark like me, and you can see here that we are presented
with all the interfaces that you can choose.
So, as I said, this is going to be
the chosen interface for me and then you can go down below in the same window where
it says capture filter for select interfaces.
So here you're going to choose the filter
that you would like to filter on the fly while you are recording the traffic from.
And in this case, as we said, you can hit here and all the
options are presented from the Capture filter menu that we have.
Looked into it earlier, and if you go down here, we can find this
filter that we would like to apply, that we want to capture the traffic of a
particular host, that we set it out to be here.
So we are going to choose that.
And you can see it immediately on the section of Wi-fi.
The capture filter has been applied.
So if you go ahead now and start, you will
start capturing the traffic only that is going in and out from this
specific IP address or to just go ahead and hit start
and you can see the source and the destination IP always will include the
traffic coming in and out of this IP address.
You can see it all the way down here.
So you can see my router
trying to communicate with this IP address and so on and so
forth, so you can let it run as long as you want onto your satisfied and you have
captured enough packets, you can just go ahead and hit stop.
Then you can go and then you could go on and save this later on and.
You can apply more filters after that, but since you can see.
As you can see from here,
we have captured all the traffic going out and coming in from this IP address.
So that was it for this video, and when
you're ready, you can go ahead and click on the next video.
Where we are going to analyze SSL Stripping Attack.