‫So in typical traffic capturing on a network interface, there are a lot of packets received from and
‫delivered to all over the network.
‫And, well, the internet as well.
‫So let's see how we can take a picture of that network.
‫Let's go to Carly and start Wireshark.
‫You can start Wireshark from the applications menu or open a terminal window and type Wireshark to start
‫the app.
‫Don't worry about the ampersand in the end of the command, putting an ampersand at the end of a command,
‫it causes a shell to run the process in the background.
‫It's sort of multitasking.
‫You can have many processes running, but only one in the foreground at any given point.
‫The process in the foreground is the process that appears to have locked up the terminal, whatever
‫the first message is, because we are a super user on.
‫No worries.
‫OK.
‫The welcome page of Wireshark asks which interface we would like to listen to first.
‫So let's have a look at the interfaces of our system.
‫To look at the interfaces and to remember the IP address of Carly over the terminal and type if config.
‫There are two results yet of the config command, if zero and l o.
‫If zero is the first Ethernet interface, additional Ethernet interfaces would be named if one is two,
‫et cetera.
‫Here we have only one.
‫Now, Ello is the loopback interface.
‫This is a special network interface that the system uses to communicate with itself.
‫If zero is the interface that we're interested in at the moment.
‫Double click to open the E0 on the main page of Wireshark to start capturing the packet passing through
‫our Ethernet interface.
‫Now to speed it up, let's create some network traffic.
‫Open one of my virtual machines OWASP, BBWAA and Ping Colli.
‫To stop Ping Command, press control.
‫See ifconfig to learn the IP address of the machine.
‫Now I go to another VM, Metasploit and paying the last VM first.
‫And then Ping, Carly.
‫Here we have a lot of ICMP and art traffic at the moment.
‫So let's generate some traffic.
‫I open the browser and call and visit the website served by the OWASP BWR machine.
‫And even more traffic, I visit NHS Dot UK.
‫My favorite website.
‫OK, that's enough.
‫Let's turn back to Wireshark, as you see, we have a lot of packets captured and new package arrive
‫every second our packets, TCP packets, TLC packets for HTTPS traffic, etc. Here, we don't investigate
‫the packets in detail.
‫We want to learn about the systems which are interacting with us.
‫So go to statistics menu and select conversations.
‫There are five tabs in a conversation window by default.
‫And we're on the IPv4 tab at the moment here, there are IP packets grouped by Address A. and Address
‫B and each line we see how many packets sent up to now total size of the packets in byte number and
‫size of packets from A to B and from Betway, et cetera.
‫There is traffic between 8.8.8.8 and my colleague.
‫Now, I know that 8.8.8.8 is the IP address of Google DNS, so I must have set the Google DNS as the
‫DNS of my colleague.
‫You know, I'd like to look at the network config.
‫And yes, my DNS address is 8.8.8.8.
‫The Ethernet tab, we can see the Mac addresses of the systems.
‫The address is full of F's, meaning that the packet is broadcasted AAP requests or the examples for
‫these kind of packets.
‫In the TCP tab, we can see TCP packets grouped by the addresses and this time by ports as well.
‫Because the system may have different interactions with any other system, for example, calling may
‫have aged traffic through Port 80 and at the same time, it may have an associated connection through
‫22 as well.
‫Same as TCP package are grouped by ships and ports in the UDP tab.
‫Here we have learned a lot of live systems, IP addresses and Mac addresses.
‫Just listening to the traffic go through our network interface.
‫If you like to investigate the traffic between the two machines, select a line, right click if you
‫choose, apply is filter from the menu.
‫Only these kinds of packets will be seen in Wireshark.
‫I'll choose find at this time.
‫As you see automatic query string is prepared.
‫I can navigate between the packets by clicking the Find button.
‫Go back to the conversation window at the bottom right, there is a conversation type's button when
‫you click on it.
‫A lot of different protocols are listed.
‫These selected five are the default selected protocols.
‫You can add any protocol from the list when you select one of them, a new tab is added to the conversation
‫window.