Check it out.
It's time for us to get ready for an upcoming assignment and notice we are going to be doing none other
than utilizing Wireshark in this next assignment.
So notice I'm doing a Google search for Wireshark and we are going to be brought to the Wireshark dot
org site.
What we're going to do is download the popular Wireshark.
I'm on a Windows platform, so I'll choose the 64 bit Windows Installer.
What we are going to do with Wireshark is we are going to sniff packets.
That's right.
We're going to capture packets off of the wire or the wireless environment and we are going to analyze
their contents.
Notice you've got to get on a machine that you can download Wireshark to, and this is typically going
to be a machine that is not in your corporate environment.
As you know, your corporate environment, firewalls and policies are probably not going to allow you
to download and install and enable.
Wireshark Because this is one of those tools that could be used maliciously.
So your first order of business is going to be to get into a place on equipment where you can indeed
download this free tool.
All right, I've got it downloaded.
Let's go ahead and open the file.
And that should kick off the installation executable and it does.
All right.
So we are going to say noted and notice that we have the ability to download all of the components.
So that's great.
And do we want a quick launch icon start menu desktop?
Yes, I'll do all of these associations, get all of these icons.
Notice we are installing into the default location and then notice that there's this ENPI cap.
What this is going to enable us to do is capture the live network data from our network.
So that is perfect.
We'll go ahead, install in and install that.
Should we have traffic coming in via USB devices, maybe we have a USB type of adapter for receiving
wired network traffic.
I know on my laptop I'll often do that.
I'll go ahead and connect Ethernet via a USB adapter that I have to give myself a wired connection.
Since we don't have that, I will not install that option.
All right.
Well, this install is going to go very quick, so I'm just going to stay here live with you, because
I want to make sure that, you know, we don't do the old.
There were tricks up my sleeve and you didn't get to see things that might have been required.
By the way, in case you're wondering, I am on an HP Omen laptop right now and it is running Windows
11.
So this is a Windows 11 system that we are installing Wireshark on.
All right.
Well, right.
When I said claim that it would be a very fast install, it started taking a long time.
All I had to do is complain about it and that prompted it to get going.
Here is the end Pcap installation that we said we wanted and let's check these options.
Restrict and caps driver access to administrators only.
That's a great idea.
Support RA 802. 11 Traffic and monitor mode for wireless adapters.
I'm going to turn that on and install and cap in win p pcap API compatible mode that will make sure
that I get the network traffic captured that I want someone to enable that as well.
Notice that second question.
Boy, is that an important one.
Notice that this can place our wireless LAN adapter into what is called monitor mode.
I want you to memorize that for certification purposes.
Monitor mode with 802. 11 NICS are going to enable you to not only get the data frames off of the wireless
network, but also get the control frames as well.
So you just start gobbling up on your network card for analysis all of the frames that are associated
with the wireless communications.
As you might guess, this monitor mode is something that your computer criminals are going to absolutely
love.
They're going to want to put their wireless network cards into this mode to gather traffic off your
network.
You can see why this tool is very dangerous and why we install Wireshark in our lab environments or
where it's authorized to behind the walls of our corporation.
Well, I'm going to choose next.
And.
Finish and notice that was just the install for the NW cap utility.
So now Wireshark, now that that is done, will be finishing up its installation and then prompting
us to install any additional tools that it might have for us and look at that will choose next and we
will manually reboot this computer later.
And we're going to choose finish.
That reboot is going to be a requirement should you want to stop start monitoring traffic?
Most likely on some systems.
I found that I can actually start monitoring traffic now.
But just to be on the safe side, of course, I will reboot and we will pick up right here in this video
with this demonstration for you right after the reboot.
So as you can see, we are back and we are on that Windows 11 workstation and Wireshark.
I love that icon.
Right.
So cool.
Wireshark is installed.
I'm going to double click that icon on the desktop.
And I just got an alert that several things wanted to manipulate this underlying system and.
Wow.
After literally saying yes, it's okay.
Yes, it's okay.
About four times as Wireshark was digging into the configuration of this device.
Notice it went in and started monitoring my wi fi.
Look at that.
So I am on a Wi-Fi network right now and look at that.
You can see the packet activity.
Now, if you double click if I double click that entry, notice I start seeing the actual packet flow.
So I am now capturing the packets over the wi fi.
This is the stuff that hackers are made of, isn't it?
Yeah.
We are gathering all of this incredible, useful information off of this network device right now.
Notice there is a stop button up in the top left corner.
So I'm going to go ahead and stop the capture now.
And you can see that we have up in the top pane, I'm scrolling through all of the incredible number
of packets that we successfully sniffed off the wire.
So it's an incredible number.
And notice it's in a grid and it's like a spreadsheet where if we wanted to sort it all by protocol,
we could.
So I just click in the protocol header there, and now we have sorted all of the packets.
Look at how useful this would be if we want to see what exactly is occurring via DNS, what exactly
is occurring.
The ARP notice down here the OCI model is really brought to life for us, isn't it?
Because we can see information that's in the frame.
We can see ether information in the Ethernet two frames specifically.
And if we look in here you can see the destination mac address is a Netgear device.
So this must be the device that we are communicating through.
And there is source mac address information from what appears to be an intel component.
Probably the adapter notice there is IP version for information.
So if we want to go in and look at the network addressing that, we said would be there.
There it is.
There's the source IP address and the destination IP address.
What do we notice about the source IP address?
Well, it's an RF C 1918 private use only address.
And sure enough, the destination address is a 13 dot address, which means it is part of the public
internet address space.
Here's the transmission control protocol parameters.
So now we are looking at the information that is at the transport layer.
One of the reasons I'm showing you this tool now and I'm having you use this tool now is because as
we study things like transmission control protocol, you will be able to pull up.
Wireshark captures of this information and you'll be able to see it as you are studying it.
This really brings this information to life, and I don't think I could have survived in this field
without Wireshark.
Well, certainly I could have survived in my field without Wireshark, but it sure would have made the
learning much less enjoyable, that's for sure.
This really does bring it to life, and I want you to be one with this tool, so to speak.
Thanks for watching.
And this is your prep for the assignment that follows.