Hello everyone in this section. We will look at how to
capture the network traffic and how to make
analysis.
In this lesson, we will investigate the different capturing
techniques or Wireshark.
Now let's begin.
At the beginning click on the capture options button.
And there are three main tabs.
You in
the input tab we
can select which interface we are going to sniff the
traffic.
Now let's pay attention the promiscues mode.
As you see in here.
Promiscues mode is a setting that allows the
network interface to capture all packets that
pass through the network rather than just packets that
are others to the device.
This can be useful for capturing and analyzing
Network traffic in a variety of
situations such as troubleshdink performing security
assessments or net or analyzing Network.
and to enable promiscuous mode
in Wireshark
You can select the interface firstly you
want to use for packet capture
in the interface list window in the
input in the input Pane and I am
selecting the Wi-Fi interface because I am using actively this
interface.
As you see in here for all the other interfaces
the promiscuous mode
has been selected.
And I want to uncheck these options for
the other interfaces.
Because I don't want to use the
promise Keys mode.
For the other interfaces and I just
want to choose the promiscuous mode
for the Wi-Fi interface because
I want to capture on this interface the
network traffic.
Once promiscules mode is enabled Wireshark will
capture all packets that pass through the network regardless
of whether they are addressed
to the device or not. If you
check the enable promises mod on all interfaces.
Again, all of the other for all
of the other interfaces promiscules mode
is again active.
As you see in here, it turns
to promiscues mode in active
again. So if you
aren't checked this option, the promiscues mode
is now unavailable for the all
of the other interfaces all around other
interfaces.
And I want to check the promiscue smart
for the entire face five.
Again, because I want to capture the packets on
the Wi-Fi interface and I want
to enable the promiscues mode for this
interface.
And it's important to note that
promiscues mode can significantly increase the
amount of traffic captured by Wireshark, and
it may also expose the device to
a greater risk of security vulnerabilities.
So as a result, it's generally recommended to
use promiscues mode only when necessary
and to disable it when it is no
longer needed. How can we capture the live
traffic on our Network?
After we have chosen the entire face that we want
to capture the network traffic. We will
just click on the start button.
Now the packets are streaming on our
pane.
We are capturing some packets on our Network.
on our Wi-Fi interface
and you can see the notification capturing from
Wi-Fi because we are
capturing the packets on the Wi-Fi interface now.
And that's enough for us.
for now
when you have finished to capture the traffic, you
can click on the stop capturing packets
button.
If you look at the status bar, you can
see the number of packets and we have
now 59 packets.
currently
after capturing process you can save this
file as a capturing file.
as you know say
and then you can enter a name to the
file.
After giving the name to the
file, you can click on the save button, but I
don't want to save this file for now.
So I am shutting down the
window.
And now we want to use a capture filter
during capturing our packets on
our Network. So I'm shutting this file.
And again, I want to go to
the capture options.
And in here as you can see
capture filter for selected interfaces.
And you can enter a capture filter
in here.
So you want to create a capture filter
to only show us traffic sourcing from
or distant to
our IP address personally. I
want to see my IP address.
so as you can see, my IP address
is
In here, and I want to use
this IP address as a filter.
Now I am typing my filtering code.
And click on the start.
Now we will see the only packets from
the this IP address.
Only the packets sourcing from
this other this address and
distance to this IP address.
There is no another IP address as a
host IP address only this one.
only this IP address as you can see
So now we can stop the
capturing option capturing process
and we have stopped it.
And we have 126 packets
now.
As you can see in status bar.
And we can close this capture file without saving.
continue without saving
and I want to close this
option.
as well
Is then another method to capture a
network traffic we can take a file we
can take a capturing file that we
have captured before and to
do this we can go to
the file menu and open option
click on.
For example, I want to open the my first
chip file.
And click on the open.
Then you can have a network
traffic.
That you have captured captured
before and third option
to have a capturing
file to have some packets on
the network is the capturing is
capturing from the common line.
And through this we will open the comment line.
Firstly I want to close this file
again.
Close this capture file.
And when you are opening the comment
line in the windows to capturing from
the command line and you should be
the administrator. So you should run the command
line as the administrator. Otherwise,
you will get an permission
errors and
So when we are opening the command line.
first right click on the command prompt
and run as administrators.
Now as you can see, we have opened the common
line as administrator.
That is important to us.
Now navigate to directory a Wireshark
has installed
I want to go to my directory.
Then we will follow the comment to start
capturing packets with t-shark. T-shark
is used to capture the network
packets on the common line.
as an attribute for the Wireshark
and people use the t-shark.
So now I have written the row format
for the T-shirt comment. And
in this comment, we will
we will replace the entire face part
as our interface and
we want to capture the traffic on
Wi-Fi interface. So
I will write in here as an
entire face Wi-Fi.
And you should pay attention when you are writing the
name of the interface because it is
case sensitive.
So it is important whether the letter
will be upper or lowercase and
I want to replace.
my output file name
And in here you will specify the location of your file that
you will save your
network packets.
And I want to write my location.
So I'm giving a name to my file.
new t-shirt cap
and then
you will specify the extension of your
file.
And now if we press the enter we
will start to capturing the network
packets.
And press the button enter.
Okay now press Ctrl C to
stop the capture and save the packets to
the output file.
That we have specified before in here.
And I am pressing the buttons DRL and
C.
Let's open the pickup file that we have created.
And the file is here.
click open
Then we look at the status bar. We can see the package
number and we have
56 Network packets.
And we captured these packets
with the t-shark on the common line.
This was the another way to capturing our
Network topic.
the last method I'm gonna show you about the
capturing remote
connections capturing about the remote network
and to do this. We are
opening again the capture options and in
here you can see manage interfaces
option.
so
we are clicking on the managing interfaces and
you can add the remote interface using
this button.
Adding button at the remote host and
its interfaces.
and when we click on the
Remote interface button. You can add your host
IP address in here,
then you can add its Port
information.
And after adding these information you can
use an authentication with the
password with the username and password or now
Authentication.
You can use then you will
click on the okay.
I didn't enter any information.
and
When add the remote interfaces information you
will see your remote interface
in here and you can click
on button. Okay again, after these
operations, you will see
the interface the remote entire face on
the input window.
And you can capture the packets
on the remote interface by using this
way and these are the features of the input pane.
And that's all when we pass
to the output pane. We can see in here
a file field and you
can use a file pad with
writing directly or
using the browse button
and you can choose a pad in here a file.
You can choose then you can
click on the say.
To capture to add Paramount file
you can use this field. You can
also arrange the output format as
pcapng or pcap what
are differences between them?
TCAP is meaning a packet capture.
I mean pickup is the shortcut that
packed capture and
the pcap engine means packet capture
Next Generation.
And these file extensions are
bought file formats for storing captured
Network traffic.
Pcap is the original packet capture format
while pickup NG is an extension
of the PCAT format that was developed
to address some of the limitations of
the origin of format.
And some of the key difference between pcap and
pcapng.
Are like this PK files
are supported by a wide range
of tools including Wireshark TCP dump
and many others PK PNG
files aren't as widely supported, but they
can open and analyzed using Wireshark and
a few other tools.
Anti-distructure difference is
PK files have a simple structure with a
single Global header followed by a serious
or packet records pick up and G
files have a more complex structure with multiple
block types that can be used to store
different types of data.
And the third difference about between the
these files in this
way. We kept PK files
have limited extensibility as they
do not include a way to store additional metadata
or other types of data pkbng
files on the other
hand are designed to be extensible and can
include a wide range of additional type
data types. And the last difference criteria
is performance and pickup
files can be large and difficult to
process.
Especially when capturing traffic
from high bandwidth networks
and pick up NG files
are generally more efficient and easier to
process.
As they are optimized for storing large amounts
of data.
These are the differences about these two extension and
the pcap
engine file format is the default extension
if you don't specify the
extension in Wireshark, so
And the other window is the
options window.
So in here you can see some display
options.
Name resolutions and display options
are update list
of packets in real time. And we
also use this option
by default and automatically
scroll during live capture, you
know.
Some pickets are streaming continuous and
we are observing packets.
Up to down and there's streaming in
this way. So automatically scroll doing
live capture in this
way. And the other choice is
showing capture information doing
live captures and we are not using
this option by default and name
our resolution under the name red
solution. We have three options
resolve Mac addresses resolve
Network names and result transport links.
In Wireshark, the result make
other races option is a feature that enables the
tool to resolve the Mac addresses of the device on
network and displayed them in the packet
capture by default. This option
is enabled as you see
which means that Wireshark will attempt to
resolve the Mac addresses of the devices in the
capture and display them in the pack list
and other views.
As you can see in here, we can
see the device name Intel
Core as Intel Core. So the
Wireshark has resolved
the MAC address to the name to the device name
and how the result Mech address option
works in by shark Wireshark maintains
a MAC address resolution cash.
As it processes the packets in the capture
Wireshark maintains a cache of the Mac addresses
that it has seen.
So this cash is used to store the MAC
address of the devices on the network and corresponding
pip addresses Wireshark uses
the cache to resolve mechanalysis. If the
MAC address is not in the cache Wireshark
will display the MAC address.
In this plural form, so it couldn't
resolve this Mac address and we
are seeing it.
in the row form as in here, but
these Mac addresses has been resolved and
we can see the device names.
So it is the resolving Mac addresses
and the other option under the name
of the solution. You can check the
result Network names.
And the last one the resolve transport names
as you can see and that's all
about the Wireshark capture options window and
we can close.
We will talk about the Wireshark interface and
device I model relationship on
the next lesson, and so see you
on the next video.