Hello, guys, and welcome to another video
on this chapter in this video, we're going to find a way
how to look for data when you suspect malicious traffic. Wireshark
has a lot of directors and understands the vast majority of protocols.
So usually when you're capturing some network traffic and you
dissect through the traffic, you can see that Wireshark translates and understands
pretty much everything like DNS queries and so on and
so forth, you just jump straight away into the Wireshark.
So you see how we can see that difference in the unwanted IPS traffic.
I have opened here a captured file
in my Wireshark that it's HTTP traffic that it's like and it's been downloaded.
So you can see that there is some DNS queries and some TCP transmission.
And if you go through all the files, you can see that we're using Google to search
and download the file and so on and so forth.
So.
You can use protocol hierarchy so you can see that everything is going on in a
healthy way, so you can just go ahead to statistics and protocol hierarchy.
So a new window pops up and here you can see all the the packets,
those made and the beats per second and so on and so forth.
So if you go to the user data protocol
that you can see some domain name system translation from Wireshark, which is the
DNS queries, if you go to transmission control protocol, you can see the TLS
here Transport Layer Security and so on and so forth.
As you can see Wireshark understands and.
That sets everything and records everything to.
But you can see Wireshark translates everything from all the protocols.
So now let's just change and open up.
Some
file from network traffic that we captured and that we suspect that there is some
kind of like a suspicious activity going on there.
So you can go through the file and see
what is happening, all the transactions that going back and forth.
Byte line, and you can also.
Go ahead and use the.
Statistics again, and use the protocol
hierarchy, as you can see, everything is broken down here, the UDP protocol, the
DNS query, and also you can see here in the TCP the Transmission control protocol.
There is some data.
But usually Wireshark doesn't dissect or understand something,
you just described it to plain and simple data.
So that might or might not be some kind of like suspicious.
So first, it should raise some flags to
you and you might want to investigate that further.
So you can use that data, you can right, click on that
appliance filter and select it so you can close that.
And you can see now the our traffic is being filtered
to the so-called data that I couldn't translate based on the
protocols, and the dissectors that it has that you can see some non-standard ports
use and communication going back and forth with the PSH ACK command.
That's kind of a little bit
suspicious, to be honest, when you see something like that going back and forth.
And.
That is very useful when you are doing
forensics or network troubleshooting so you can go to each line.
The Network stream, and you can just
investigate further what is happening there in order to determine if this
traffic is indeed unwanted and suspicious and malicious traffic.
So I hope that video was informative
enough in order for you to understand and differentiate healthy from malicious
traffic, and when you're ready, you can go ahead and click on the next video.
What's we are going to have a look deeper into the denial of service attack?