‫So Wireshark is not a disaster movie set in the wide open sea.
‫It is a free, open source and the world's foremost network packet analyzer, and it is the de facto
‫standard across system and network administrators with a graphical user interface.
‫Wireshark has the ability to listen and record traffic, as well as advanced filtering and reviewing
‫options.
‫So I'm going to visit a HDTV website first, then an HD TPS website.
‫Let's go to Carly and run Wireshark.
‫You can open a terminal screen and type Wireshark to start it.
‫So these are the network interfaces that Wireshark is able to listen to.
‫You open another terminal screen and run the ifconfig command to see the network interfaces.
‫So as you know, if config stands for network interface configuration.
‫So if we use the command without any parameter, it'll list all the interfaces available.
‫We have E0 zero as a network interface to listen to.
‫So now I'll turn back to Wireshark and double click eth0 to select it.
‫Now, Wireshark starts to listen to the Ethernet interface of Carly.
‫And to create some traffic, I'll open a Web browser and just visit an arbitrary website.
‫And now we have enough packets to examine, so I click the stop button at the upper left corner of Wireshark
‫to stop listening to the traffic.
‫So first, we have some DNS packets to find out the IP address of the visited site.
‫We'll look at these kinds of packets soon, but right now, let's just have a brief look.
‫So a DNS query for the IP version four.
‫Another DNS query for IP version six.
‫Don't worry about the versions right now, we'll cover them soon, I promise.
‫These DNS queries are transferred as UDP packets in transport layer.
‫The destination port is 53.
‫This is the IP packet with the source and the destination IP addresses.
‫So we'll go through the layers one by one, and we'll see all these packets, data grams and frames
‫in detail.
‫So we'll keep going.
‫This is the structure of the Ethernet frame.
‫First, there are two DNS queries for Dub, Dub, Dub, Hacker Academy, not UK.
‫One for the IPv4 address, and the other one is for the IPv6 address, and because the website is redirected
‫to hacker academy Duke, there are two more DNS requests for this address.
‫Next, DNS packets are the DNS query responses.
‫This response is type A.
‫That means it's an answer for the IPv4 request.
‫And here's the answer.
‫The IP address of the website.
‫Now, Diane's response packet uses UDP at the transport layer, IP at the network layer, etc..
‫Here we have a TCP handshake between Kali and the Web server.
‫We'll also see this in detail later on.
‫A sin packet, a snack as a reply and an act packet to complete the handshake.
‫This is an HTTP get request.
‫We learned the IP address of the web site and now the system is ready to receive the web page.
‫FTP protocol in application layer.
‫Now you can see the headers and the parameters of the request.
‫TCP protocol and transport layer, source, port, destination, port flags, etc..
‫IP protocol in network layer.
‫Here are the source and destination addresses.
‫And Ethernet frame in layer two.
‫These are the TCP packets which will build the HTTP response.
‫So in this example, it's the web page.
‫In other words, the response is transferred between the web server and our system as fragmented packets
‫in transport layer.
‫Here's the fdcp response 200, OK.
‫So the Web page is received.
‫And here's a data, which is our web page.
‫These are the response, detailed response type, headers, et cetera.
‫Here there's additional information produced by Wireshark, which says that the HTTP response is created
‫by reassembling five TCP segments or packets.
‫So now I'd like to show you the difference between that and HTP s traffic.
‫So I'll go to the browser and visit an HD https page now.
‫But before visiting the page, let's start Wireshark.
‫Here's a start button continue without saving.
‫OK, now we have a clean sheet.
‫So I'll go to the browser and hit Enter.
‫Wow, lots of packets in milliseconds.
‫So we've got plenty of packets to investigate.
‫Just click the stop button once again.
‫OK, so the DNS request and the response packets first here is a response with an IPv4 address.
‫Here there is a TCP three way handshake between Cali and Port, four for three of Google's web server.
‫And now a client.
‫Hello, TLC packet to start the TLC handshake again between Kali and Google server.
‫Now, to get rid of the other traffic records, I'd like to filter the results by the IP address of
‫the Google server.
‫Now, while the mouse pointer is on the server IP address, right click and go to apply as filter and
‫select the selected option.
‫So as you can see here in the filter bar, the IP address is assigned as the destination IP address.
‫Now we only have to see the traffic where the destination is the Google server, but we'd like to see
‫both the incoming and the outgoing traffic.
‫So I'll change the DST part of the filter to ADR and click the blue arrow to activate the new filter.
‫Now we can see the traffic in both directions.
‫OK, so here we are at the hello to your last message.
‫Here are the details of the message TELUS uses TCP protocol in transport layer the Google server replies
‫a server hello message as the second step of the TLS handshake.
‫Then comes the certificate and server key exchange and the server Hello, done message is sent by the
‫server.
‫Carly sends the client key exchange, Google server sends a new session ticket.
‫And the encrypted communications starts.
‫Here is some encrypted application data, which is meaningless for others who listen to the traffic.
‫And as you can see here, the message is encrypted at the application layer, so you can still see the
‫source and the destination addresses the ports, et cetera.
‫This is how an IPv4 packet is seen on Wireshark.
‫So it's a DNS query response.
‫The fields we mentioned are seen pretty clearly.
‫Versions for.
‫At length is five words, which means no options for you.
‫Total length is 96 bytes.
‫Mfe and deer flags are not set.
‫And you can see the source and the destination addresses and all the rest.