To be able to understand the traffic that showed in wire shark.
Let's first discuss some network concept and then we can translate it to a way of shark traffic.
So what exactly is happening when you try to open or browse a website from your computer.
So we have a computer here like Mike Kelly Linux computer and then you open your browser and you type
W WW dot MSM dot com or w w w dot google dot com.
Do you think request will be going straight to Google's server or M.S. and server to request the page.
No usually in any communication between two devices there is some initiation first.
There is three different steps at the beginning.
So when you open your browser from here and you type w w w that Google dot com what happened that Eric
Packard called a send packet will be sent to the Google server and then to the Google server will be
replying back with something called Sin EQ.
And then my machine will reply back with EQ or acknowledgment and then the connection will be established.
This is how the communication is initiated between any DCP connection and to give you a small example
about that.
It's like when you are trying to call someone it's not like you dial is a number and once it pick up
the phone you start talking right away.
No first you're saying hello.
This is like notifying games that you are on the line.
And then he would reply back to Hello mean I can hear you please resume.
And then you're going to tell him.
Can I speak to John.
And then you start a conversation for instance.
This is like a simple example how it get initiated as a beginning.
So considering that let's get back to our
wire shark and let's see the traffic that has been captured and let's compare that to what we know about
by the way is this initiation is called a three way handshake.
So let's see.
So as you can see let me just increase the size for you
so my computer as I told you earlier is 1 9 2 1 6 8 163 1 160 3 138.
So once I start the initiation request a DNS request has been sent to my DNS server.
This is a DNS server which is 1 9 1 6 8 1 66 2.
And the purpose of the state DNS is to resolve the IP is the names that I sent which was the Google
dot com or MSM dot com to the IP.
And once it reply back and actually the IP for the server that I sent was 2 0 4 7 7 2 9 1 97 2 0 3.
So as you can see this is a server if you see the initiation between my computer and the server.
What is the first package that has been sent from my computer to the server is a sent packet.
Then the server lets take it from here.
Better yet.
So we have here.
Uh yeah.
Let let's take it from you.
I think this would be easier to understand.
So I'm trying to open a web site so it's sent to the server that have this Web site is sent back.
As you can see.
Now what happened is that the server reply back was it sent back as we saw.
Right.
So the server reply back to my computer was Sinek.
Then my computer reply back with an egg.
OK so that's me in those three step are the three way handshake.
And once they went through those three steps.
Now the server will send me the order.
My computer runs it.
It is the three way handshake has been complete my computer sent an HD TTP request TTP get request to
the server.
Could you send me the page now.
And then the server reply back so you can understand the traffic from here.
According to the network communications definitions that we know one good thing about what it can show
use it not just showing user communication is between which to computer and what kind of traffic.
But you can even right click on it.
And this is actually very useful and we're going to use it in some cases.
And you can use follow dump follow CCP stream and follow DCP stream will actually get user traffic and
the request that has been sent to me.
So as you can see this is the TTP get and it shows you the the H.J. Jamelle code that has been sent
and received and you can even see the link of the image in some cases this will be very useful insights
attacks and you get to know some critical information so you can even see the traffic not just monitoring
the traffic is going from where to where you can even see Twitter don't get disturbed you know with
with the achievement code or the hex that buys the time for sure you'll get to understand more and you
get to analyze deeper but this is showing you a small example on how to analyze where shark traffic.
Now let's take another example to analyze where shark traffic.