Hey, everyone, welcome back to the
course. So in the last video, we
went ahead and ran our Netcare
command, so we went ahead and
took a look at the words I typed in.
So the dog, cat and bird.
And we noticed that when we clicked
in, followed the TCP stream, that
the words that I typed in actually
showed they were we were able to
successfully capture them.
And you should have had similar
results on your end.
Now we're at step 34, the lab
document. So we're going to go ahead
and stop our traffic capture inside
of Wireshark. So basically, we're
just going to click this Red Square
icon at the top here.
And then once we do that, we're
going to locate any packet that
has an acknowledgment flag with it.
And then we're just going to take a
look and look for the source and
destination IP address here in
question number two.
So let's go ahead and do that now.
So just click on the stock capture
there. So that Red Square there,
once you click it, it's going to
kind of grade out. So, you know,
you're successful at that
and then not just find any packet
that's kind of acknowledgment flag
with it.
I'll just pick on this one right
here.
I see that I have a knowledge of
flag. And so, again, question number
two in our lab document was
basically just what's the source and
destination IP address?
So we see here on my end at least
that I source source IP
excuse me is ten to zero,
ten point ten.
And then my destination, destination
IP addresses ten point zero, 10,
12.
All right, so that was a pretty easy
question there for everyone.
So the next thing we're going to do
is actually open up a pre
saved packet capture
and we're going to take a look at
the information in that.
So the way we do that, we're just
going to select file at the very
top left here of Wireshark and then
select open.
I was going to ask us, you know, do
you want to continue with austerity?
Do you want to save what you're
doing right now? Essentially, the
scans that we're running, we're just
going to select and continue without
saving option. We don't care that
we're losing that data.
Our next step here were to select
desktop on the left side.
You'll see mine has defaulted in
there already, but we're to select
desktop on the left side.
And then we're going to go to the
capturers folder and then select
the actually the file I have
highlighted here, the capture to
copy cat.
So that's going to be steps 39
through forty one.
So let's go ahead and do that.
Now we're just going to select
desktop on the left side there,
double click on Capturers and in the
very top option there, the capture
to to pick up, just go ahead and
make sure that's highlighted and
then just say open.
You'll see it's going to open up in
the background there and sometimes
you'll see a filter typed
into Wireshark here, specifically
related to TCP.
If you see that, just make sure you
click the clear option to clear it
out, just like mine looks right
there. So you just want to blank
Bokser that way.
It shows you all the packets that
are in that capture.
Let's go back to our lab.
In the next day, we're going to do
is I should look for this package
right here. So package number 22,
a six, so that we're we're going to
do that. We're going to select
go at the top here and then
go to packet.
Once we do that, it gives us a
little search box here, just type in
2002, 86.
So again, that's right here in step
43 ever lab document.
And then we're select the to option.
So it's going to be this bottom
right button right here.
Once you select that, you'll see
it'll jump to, as the name implies,
package number 22, 86.
Let's go back to the lab and we have
a few questions we want to answer
based on this particular packet.
So questions three or four
are related to the source, IP and
IP address. Important number.
So if we take a look here, what do
we see?
Ah, so we see that packet twenty
two, eighty six, we see it's running
on a source IP
address of to about one
six eight dot two hundred
fifty one.
We also see that the destination IP
address here is one hundred two
point one six eight two hundred two
hundred, and then, of course, our
source port, if we look here at the
bottom, is one thousand
sixty two and a destination 110
or pop three.
All right. Let's go back to our
document here. So you'll see we've
answered questions three, four or
five and six.
So let's move on to step 44 here.
So this is our last step for this
particular lab.
So we're just going to right click
just like we had done before, where
we follow the TCP stream
and we just want to. Right click on
this package. You just take a look
at the information that we see in
this particular packet.
So question number seven here.
What information do you actually see
on your ID?
So all we have to do again, just
right. Click on that packet, follow
TCP IP stream and we can take a look
here.
Ah, so when I see a Miandad, you
should actually see the same thing,
since we're all using the same pack.
No, here you should see that it
looks like somebody logged in here
with username a student and a
password of my secure.
So, again, one of the main things
that we try to capture here using
Wireshark is going to be
credential information.
So specifically usernames and
passwords could also be pass
phrases or something like that, or
even even keys in some situations.
But in most cases, a username and
password are going to be the things
that we try to capture.
Ah, so in this lab we just took a
little look at Wireshark again.
We're going to be using Wireshark
quite a bit through these four
different labs and we'll do hands on
as well as TCAP done.
So the next video, we're just going
to go over some more packet
sniffing.