Hello everyone in this lesson. We will get familiar with
Wireshark. Graphical user interface. Here
we go now.
On the wireshack graphical user interface. We
will first look at the pack this pane they
could this pain is located at the
middle of the shark window.
In here, you can see this pain.
Is the packet list pane?
as you can see
and it displays a list
of all the packets that have been captured before.
And we see a summary line of
each packet.
each packet along with summary information
we can use this pen to navigate through the packets and
select.
specific packets for further analysis
one by one you can choose
a specific packet
on this pane
And to pick up this pane also includes
a number of columns.
as you can see
some columns
in here
The First Column is the number column and it shows us
the number of the each packet. The
second one is the time column.
and the other one source, then the
destination and protocol columns
and the lastly length and
info columns we have
so we can add or remove columns to
change what information is presented in here.
And we can do this in different ways. The
first one is to right click
on this.
Column and column preferences
we can click on this.
We can go to the column preferences.
or
in another way we can go to the edit menu.
And click on the preferences.
So in preferences window,
you can see another preferences in
there.
And you can choose the columns.
as you can see there's
but the easiest way
is the right clicking on the columns
and clicking column preferences.
So then you can add or remove
the columns.
If you click on the add a new column.
You can see there we can add a
new column.
And you can write a name to here as a columns name.
For example, I want to write a
Mac address
then you can specify the type of
the column.
In this way, you will Define what kind of
information the column will show us.
So I will choose.
the MAC address information
And my column the new
column will show us the hardware destination
address.
Which means Mac address?
and
I'm clicking on the ok.
As you can see there.
The MAC address column is
in here.
And I want to change the location of Mac address column.
Because this is the destination Mac address.
And I can change its location
in here.
after the destination column
I want to put in there so.
I'm moving again.
And that's all.
Now there is a MAC address column which shows
us the destination Mac address.
Now we can remove this column again.
And to remove this column we are clicking on
the remove this column.
We have turned to be registration.
on our window
There is no more Mecha there is column.
Also, you can customize that which columns will
be displayed on this window.
in the packet list
pane
If you remove the check sign on the number column, this column
will disappear.
Now there is no more number column on our
window.
Again, we can add.
We can display the number column.
Putting the check here.
And the number column is again displaying on
our window.
And to pick details pane is located below the
packet list pane.
Here, this is the packet detail
pane.
Take a details pane displays the
details of selected packet.
And including the packet heater and payload, it
will divide it down into segments as
we would imagine from an OSI model
reference.
So the packet is split into separate and capsulation levels.
And keep in mind that Wireshark will
display this encapsulation in reverse order.
With lower layer encapsulation at the
top and higher layers.
at the bottom of the window
So each of these represents a different level.
of the communication
Can expand each layer to see the
details of the fields within it?
So I am choosing.
A packet to see the details.
and
I will choose the first packet.
And you can expand each of
these details.
I want to expand the frame.
and as you can see
the end capsulation type is ethernet.
So
the packet it is pain also includes a
number of tabs that provide additional information
about packet such as the packet bytes
the conversation statistics and the
packet expert information.
And in here level by level.
You will see the details.
of the packet
and these details are being short as
based on the OSI model
you can see the destination information here.
and the source information and
the other one Internet Protocol version 4 IP
version 4
information
for example The Source address
the IP
Is in here and to destination IP addresses
in here?
and in the TCP
under the TCP segment
You can see the source Port destination port.
and some hearing formations
check some status.
and the other options TCP option
and queen
The other pane is tacket by
its pain the packet by its pain is located on
the right side of two packet details Pane
and this place the raw data
of selected packet is a series of hexadecimal and
ask values.
These are the hexadecimal values and these
are the ASCII values.
You can use this pane to see the exact content
of the packet and understand how
it is structured. The packet pipes pane
is divided into the two sections as you
see
the hexadecimal View
and ask you
the hexadecimal view shows the role date
of the packet as a series of hexadecimal values
while the ASCII will
shows the same data as ASCII characters.
If I choose the internet part, it corresponds to
some bytes of the bytes Pane
and you can see it highlights as
blue.
in the right side
if I choose the another one.
IP version 4
and it corresponds to the other bytes of
the byte pain.
And the last one of the bytes.
TCP protocol part
two people protocol part is corresponding to
the last part of the bytes.
Then you choose the frame part.
It corresponds to the all of the bytes.
And the status bar is located at the bottom
of the Wireshark window it displays information about
the current capture number of packets captured
is in here.
We have now 43 packets
and how many of them are displaying now
if you apply a filter the displayed
number will change.
So this is the total number of the packets and
how many of them are displayed in
here.
So let's move on to the main toolbar is
in here.
And it includes the starting capturing
packets or stopping it
and restart the capture current capture
and the capture options
is another tool and
this button resize back
list columns to fit contents.
We can change the length of the columns like this.
We can make some change about the
columns.
columns length
After these operations, you can you can
convert to the previous situation these
columns by using this
button resize packet list columns to
feed contents. It has turned to the previous
situation.
the menu has some
headers as you can see the file menu.
Open the file open recent.
previous files
That you have opened before.
And merge some pick some PK files
you can merge some PK files using
this option.
and importing operation you
can use this and
you can and you can import from hexthump.
And to close the current file using this
button and the saving and saving
guests as you can you as you can know.
And save as you know.
and file set
there's an export objects option. We will use later with
this.
and
when it comes to edit menu find
packets.
the useful choice for us
when you click the find packet.
There is a field.
To find the packet.
but
they will change this field first.
We will change to string.
Because I want to search a string on my
packets.
I want to search for a packet which contains a
download?
And hitting the enter it
is found the packet which contains download
string.
Then I want to make it cancel.
Now we are turning to the edit menu.
And find next find previous.
Are also being used to find
the packets and Mark packet is another
choice for us marking to
to Mark some packets that
we want.
You can Mark some packets in
here.
I am choosing.
Randomly some of the packets.
to mark
as you can see
and then you can use the menu option
or you can use the shortcuts. There
are plus n
and I will do this with Ctrl
and
so
we have marked the packets that we have chosen.
We can unmark these packets again.
one by one or
we can choose all of them.
And I am choosing all of them now.
again
so
unmarked shortcut is the Ctrl and alter
and M. I
will apply this.
Under the edit menu, we can go to the preferences
menu preferences window.
And the other one is layout. The layout is
used to arrange the Wireshark things. We
have three panes in our window and
we can arrange them in here. We are
using this style for our
paints and we can change to the other
type of the layout.
I want to change to this.
So the paints will be located in this
style. Number one will be
packed list and
into will be packed details and the
below this pain packet
details pane number three Pain
Three will be packed parts.
So you can arrange the pain situation in
here and if you click to
the ok.
Our pains have been arranged to this style
now.
and
and I will turn it back to the previous mode.
in the edit preferences
and then choosing the
layout and I am converting it
back to the very smart.
and the same
and the same sequence on the previous mod.
And I am saying okay.
as you can see
now the pains.
Are located in the previous mode?
Under The View menu, you can arrange also the
time display format you can arrange the
time information in here.
Now by the default we can see the seconds information.
on our packets
as you can see
just we are seeing the second
formation.
one by one
It's increasing.
with the packets
But we can change this format.
to another one
and
now
our format is the second since first capture
packet.
And I want to convert it to.
date and time of the day
I will see the time information like this.
So you can change again this time
format.
into another
for example, I want to
see like this.
I want to convert it to UTC date
and time of day format.
if you do this
You can see the change.
and again
Turn it back to the previous mode.
Just seconds.
second since first capture packet
So it turns back in.
Under view menu click to the result Network
addresses.
Can see the IP addresses are disappeared.
Because Wireshark will use a
name resolver to convert an IP
address to the hostname as related with it.
So we are seeing now in here the domain names.
Instead of the IP addresses some of them
at least.
and
again, we will turn back to the IP addresses information.
Under The View menu, you can also use the coloring
rules option.
And why shark allows you to create coloring rules
that highlight package based on specific crit
areas such as the protocol Source or
destination address or packet size.
This can help you identify patterns and
anomalies in the packet capture
to create a coloring rule click on
The View menu and select coloring rules
as you can see the window here.
This will open.
our rules editor
So, this is our rows editor coloring
Rose editor where you
can create and edit your coloring rules to create
a new rule.
Click on the new button and specify the
criteria for the rule so we can
see the packets which are associated with the UDP
filtering course and to do this.
You can write your filter codes.
Into the filter field or directly.
You can click to the
button of apply s filters you
click the applies filter.
UDP filter will be applied.
And I will click to the
apply as filters.
So as you can see, the UDP
filtering has been applied.
And we can see the UDP packets only.
in our packet list pane
and the color is the same in our coloring rules
paint.
a UDP color
Even if you don't apply this filters, the
coloring rules here are applied in the
packet this window in the whole pack of this
window. For example, if there's a TCP rst packet
in packets in our
packets, you will see the color of this packet as red
in the packet list pane.
Now we can close the coloring screws window.
I will click the cancel.
and
I will cancel the filtering field chords.
Under the analyze menu the other option.
The other important option is the follow.
And follow is used to see some
streams on our packets. For
example, we can see in here
to TCP stream and if
I click to the TCP sitting
as you can see
our Network traffic based on the TCP.
now
Is streaming like this?
So we can see the terrific.
We can see the packets.
As a string.
in this window
and this is okay.
Now we can close it.
By the way, you can add some comments to the
packets that you want and
To add comment to
the packet you can use packet comments
add new comment.
and
and you can write your comments about this packet to
the this field.
So then if you click the ok.
After adding the packed comment, you can
see the comments in the packet detail
pane.
Or you can make double click.
And you can see in here also.
This is a packet command example.
That I have written.
So you can add some comments like this
for particular packets that will help the
further investigation.
Or point out importance or some suspicious
points for other.
Analysts unlike packet marking to
comments can stay within the capture file.
And until the operator remove
them.
So they are stable for us for
an analyst. It is crucial to know how to
utilize this statically information.
And it provides a quick summary of
the process pcap and which will
help another create a hypothesis or an
investigation.
You can use the statistics menu to do
this.
And under this menu, we will
first look at the result addresses.
So in this window, we will check the
hosts
this option helps analysts specify the
IP addresses and DNS names
available in the capturing file by
providing the list of the result addresses and
their host names.
As you can see the IP addresses.
In the address column and the host names
under the name column.
So analyst can quickly identify
the access to Resource by
using this menu.
Thus they can support they can
highlight access resource and evaluate them
according to the event of Interest.
and you can view the ports to
in here
and capture file comments
Maybe
so that's all about the result address.
And again under the statistics menu.
We have an option protocol hierarchy.
and this option
split down all available protocols from
the capturing file and these apps
analysts leave the protocols in
a tree structure.
view based on packet counters and
percentages
as you can see
And thus analyst can
view the overall usage of the ports and
services and focus on the event
of Interest.
And we will look at the other option the conversations
options.
The conversation represents terrific
between two specific and points. For
example, if you look at the IP version 4 column
our section
you can see in here.
two different IP addresses
is one of the other spa and the other
one is the other SB.
So there is a conversation between
these IP addresses and the
packets count.
packet bytes
packet by its length or size
totally and the conversation aspect
the conversation
Direction packets from A
to B.
And packets from A to
B as bytes.
and as bytes packet
from B to a
Etc and there's also a duration information.
in here and bits
you can see some specific information about
the conversation.
You can also investigate the TCP.
information under the TCP column
in the TCP segment
and the UDP also
You can see.
Now, let's look at the other statistics option.
And close this.
The other one is the end points option.
So what we have in here?
The end points option is similar to
the conversations option.
And the only difference is that
this option provides unique information.
unique information for a single information field
such as ethernet IP version
4 IP version 6 TCP for
UDP
Does under this can identify the
unique and points?
The Unicorn endpoints in the capturing
file and use it for the event of interest you can
use this option.
to do make some
analysis
again under the statistics menu
We can see the I/O graphs.
As you can see here.
In version the iograph feature allows
you to visualize the traffic on a network
over time.
It can help you understand how traffic patterns
are changing.
and
Identify any potential issues or trends
for example in here? There's some
TCP errors.
and
The iograph is displayed in a
separate window like this and consists of
a graph with two axes.
The first one is about the packets and
the second one is interested in
time.
You can customize the eye of biograph by
selecting the specific draft types.
You want to include and by adjusting the
time range of the data being displayed.
And there you graph can be a useful tool for
understanding the traffic on the network over time and
identifying any chance or patterns it can
also have you troubleshoot issues such
as sudden spikes.
As you saw here.
and it can also help you troubleshoot
issues such as
sudden spikes or sudden drops
again, there's a
and other Spike and drop
and it can also help you travel should.
in band feet utilization
now we can pass to the other option.
The other option is the photograph another
graph option.
and
inverse shark
The photograph feature allows you to again visualize
the flow of network traffic between
two or more devices. For
example, there are two more two devices.
And the other one to third device and
support device. So totally we
have the four devices in here.
and their IP addresses
you can see
so it can help you understand how the traffic is moving between
devices and
Identify any potential bottlenecks or
issues you can see in here.
as a picture
the photograph is displayed like in
a separate window.
and
consists of a series of notes and edit edges
and consists of a series of notes.
each node represents a device
as you can see each node represents a device.
so
or a network component and the edges between
nodes.
The edges between notes as
you can see.
there are signs or
the aeroscience and
the edges between nodes represent the flow
represent the flow of traffic between them
you can customize also the
bar graph as well by selecting the
specific devices
Theolograph can be a useful tool for understanding
especially on the terrible
shooting and the understanding the
flow of traffic in a network and identifying any
potential issues or bottlenecks.
as in here
You can see.
There are some tcps you can
see in here.
so
that is the flow graph.
And we can close now.
So why sharks graphical use interface provides a
range of features that make it easy to navigate and
analyze packets even for people who
are new to pack it analysis.
It is designed to be intuitive and
user-friendly with a range
of customization options that allow you
to tailor the entire face to your specific
needs.