In this lecture I'll show you how to use Wireshark to sniff and analyze network packets.
It captures packets in real time and displays them in human-readable format.
Wireshark includes filters, protocol dissectors,
color coding and many other features that let you dig deep into network traffic and inspect individual
packets.
Note that Wireshark is not a hacking tool. It’s used to monitor the interface of your own
computer and capture and analyze the traffic that passes through that interface.
In my opinion it is the most useful networking tool for learning how networks work and for a troubleshooting
network problems.
Of course this is arguable!
Let's get started!
Wireshark is installed by default on many Linux distributions. If it's not installed on Ubuntu or
other debian based distributions
you simply install wireshark by executing: apt install wireshark.
For Windows or Mac you simply download and install the corresponding version.
I'm opening wireshark.
To be able to sniff traffic
you should start it as root.
To allow non-root users to capture packets
you have to follow a special procedure described in this official help file. To start capturing
packets on an interface
you double-click the name of that interface in the capture section of the main screen.
For example I wanted to capture packets on eth0
and it's capturing packets. Let's visit a website!
okay!
And you see here all the captured packets.
And I'm stopping capturing packets!
Another way to start capturing packets is to go to capture -options-
select the interface - click
any other options and start; like this!
In this window you can enable promiscuous mode on all interfaces or only on a specific interface.
When a wired or wireless network card is in promiscuous mode, it can read all the received traffic rather
than just packets addressed to it. At the moment
Wireshark is capturing all the packets received on the interface.
Let's
generate some more traffic!
When you want to stop capturing traffic click the red stop button near the top left corner of the window.
You can see captured packets highlighted in a variety of different colors.
Wireshark uses colors to help you identify the types of traffic at a glance.
By default
light purple is TCP traffic, light blue is UDP traffic, and black identifies packets with errors; to view
exactly what the colour codes mean
click View and coloring rules. You can customize and modify the coloring
rules from here if you like. Let's have a look at the wireshark's main window! We notice it consists
of three main parts:
The packet list pane displays a summary of each packet captured. By clicking on packets
in this pane you control what is displayed in the other two panes. The packet details pane which displays
the packet selected in the packet list pane in more detail. And the packet bytes pane which displays the data from
the packet selected in the packet list pane, and highlights the field selected in the packet details pane.
Each line in the packet list corresponds to one captured packet. And if you select a line in this pane,
more details will be displayed in the “Packet Details” and “Packet Bytes” panes.
Now if you double click a line a new window pops up with details about that particular packet. In this
example we are seeing information about the ethernet header, like the source and destination
MAC addresses, the IP header,
these are the source and the destination IP addresses
and finally information about the TCP header and application data.
This one: http-over-tls.
By the way this is an encrypted packet. Probably you have noticed that there is a lot of information. But
if you want you can save the capture for later inspection. To save the capture to a file you press
on control
+ s like this or go to file and then Save or Save As
Wireshark can save the packet data in more than one format. You should choose the correct format
depending on how you want to open the file later.
Other network analyzers use their own format.
The most important formats are pcapng , this one, which is the native file format for the latest version
of wireshark and pcap format used by older versions of wireshark but also by other well-known
and widely used tools like tcpdump. Not all information will be saved in a capture file.
For example most file formats do not record the number of dropped packets; and I'm saving the capture
as a pcap file.
And I'm closing wireshark. At a later time you can open the file with wireshark or with other tools like
tcpdump which is a command line tool.
This is the file, the pcap file
I've just saved and I can open it with tcpdump like this:
okay!
That's all about the basics of wireshark!
Take your time to understand how it works because Wireshark is really important for any networking
engineer. In the next lecture will dive deeper into other advanced features of Wireshark, which our filters.