Hello, everybody in this lesson. We
will describe one of the most important points in
Wireshark. What is pdu? And
which part corresponds to which layer
on the OSI model?
So it is crucial to understand the packet
details.
First of all, let's see the pdus in each Network layer.
I mean what station or form of
the network packets in each one of the layers?
When inspecting a pdu on OSI
model or the tcp/ip model?
That in mind the concept of uncapsulation.
Is our data flows down the protocol stack each
layer will encapsulate the data
of the previous layers in a new
frame is short as in above bubble or
in a frame you can
whatever you want to call
and this unit in search
the relevant layering information
into the pdu's heater.
So this information change depending
on the level standing on
each level furthermore. It includes the
previous layers information, for example
in the transport layer
the pdu includes the
previous layer session layer information
and this information change
paneling on the level and it
also includes operational Flags
any choices necessary to
negotiate Communications and the source
IP or the destination IP addresses and
the ports and the transport or
application layer protocols. So it
is crucial to understand to know that the layer
progress is down as the layer
progress down. I mean layer by layer new
here is added at each
layer for example on the applic.
Layer rpdu is
a data when we pass through a
transport layer, the transport header
will be added to the to the
data and it will it will be
a segment a datagram on the transport
layer and then we will
see on the internet layer our segment
or our datagram, you know
in the TCP RP due
is segment and in the UDP, if if
the ud people call is use
it in the transport layer are pdu will be
a datagram.
And when we go to the Internet layer
or network layer based on the OSI
model our pdu will change to
the packet form. So now
in this layer our PW
will be called as packet not
the segment or the datagram because
it is now a packet and
we are calling it as packet. So
let's look at an example about these
progress.
Here is an example of a
packet capture in Wireshark with the different
layers of the OSI model indicated in here.
So initially, it's worth
noting its word pay attention
that breakout in
Wireshark.
Is in opposite in reverse order
the first layer, we will be looking at the
physical layer on the physical layer
our pdu is bit, you
know.
And the physical layer is responsible for
transmitting all data or a
physical medium such as a copper or
fiber optic cable. So when we
look at the physical layer, it corresponds to
the frame title frame
part on the packet details
Pane and when we investigate
the frame frame section,
maybe you will remember that.
It corresponds to the bits on the next
window next pane packet bytes
pane. When you look at the packet bytes
pane, you will see the bits or the
hexadecimal values corresponds to
the frame Sigma frame sections frame
part. And so as a
pdu the bit the bit unit corresponds
to the frame part on
the packet details window.
When we look at the next pdu as the
frame frame corresponds to
the ethernet header, ethernet
a part on the pack details and
ethernet part as you can see we
have some information about the
devices on our Network for example, source Mac
address and as a source Mac address
the first information the first
value is the name of the
device.
You know in the Mac addresses first
part of the Mac addresses called
as and use it as
the company name then which
produced the this device and the
next one next information raw
Mac address, you know,
the Wireshark can resolve the
Mac addresses to the name their names
to human readable format and
the other important knowledge is
the destination Mac address.
And here we can see both the
result Mac address and throw
me address again.
So the next one is the packet next
one is the packet pdu.
As a pdu the packet ring and
in this layer, you know,
this is the network layer Network layers.
This is the network layers pdu.
And the network layer is responsible for routing packets
to their destination. This layer
is typically represented by the Internet Protocol
field. And which in
this case is Internet Protocol version
4
Because our device on the
network are using Internet Protocol
version 4 and we can see on the
network layers the packet
information the packet
information include the source
IP address at the destination IP
address and if you expand the expand
the Internet Protocol header, you
can see the details about these
informations again, and the
next one is the segment or datagram, you
know, this segment are
used in the TCP protocol
as transport protocol if
they use the UDP
protocol as the transport protocol we
called as datagram are pdu.
So this pdu includes some Port
knowledge Port information.
Source Port what is the source port and
what is the destination port?
For example here some information
in detailed Source Port destination
port at the length.
You know, this is the transport layer.
And on the transport layer some information
is added.
And these information are associated with
the source Port destination port and some
checksum value.
And the last one is the data.
So the date I can be seen under
this field.
Maybe it's a plain text value
or encrypted value depending
on which protocol
has been used on this packet
and we can see that it is a TLS which
is transport layer security at
the top as a presentation layer
protocol and under the
TLs. We are able to see the HTTP as
the application protocol. Now, let's
look at an example which contains a
transport layer security. I
mean which contains TLS information
TLS data?
so we can see that is it TLS which is
transport layer security at the top
is
Presentation layer protocol and under the
TLs we are able to see the HTTP as
the application protocol.
And since the HTTP data is encapsulated
by TLS. The HTTP
data is observed under
of the TLs.
Note that the data is in
encrypted form in here.
So that's all for now. See you on the next
video.