That's the end of the theoretical part of this module Let's start the practical part in this.
We'll use wireshark to detect issues with network communications including above all those that indicate
the attack is taking or have taken place or errors in the configuration of the network services.
Will first discuss the features of the program in detail during the training.
We will use version one point six point four if you'd like to do similar exercises by yourself.
Please use this version or higher.
Newer versions are backwards compatible.
Since this is a network monitor it should first and foremost capture information sent through a network
where a shark is able to collect various types of data sent through various adapters connected to your
computer.
In our case it's a network card.
As we've mentioned in the theoretical part these can also be Wi-Fi adapters
in Wireshark.
You can configure a few options related to the adapter.
It's not that you can collect data from a remote computer.
Wireshark allows the capture of data sent by another adapter on the computer you are connected to.
This functionality works only in the Windows environment although wireshark is available in other platforms
too.
You can choose the type of network we're working with the either no networks you can choose to capture
data in the promiscuous mode where Shurkin put the network card into promiscuous mode.
The wireless settings button is inactive because wireshark hasn't detected any comparable adapter such
as the MP cap.
The data collected can be saved in one file or in a couple of files.
You can specify the rules according to which the data will be divided in the lower left corner.
You can see the settings that allow you to determine in which circumstances the data capture should
stop.
It is not necessary to sit before the screen watching wireshark collecting data capture filter is an
option use to set the data capture filters.
We have already mentioned that you ought to be careful with those filters.
You can use them when you want to diagnose the specific situation or a particular problem.
For example to collect the data addressed only to TCAP port 80.
The age TGP protocol data or to examine the communications of a particular host
while collecting data in order to create a baseline or to make sure that everything is working normally.
You should not use data capture filters.
There are also a few display and name resolution options.
As we've mentioned you should turn this off in case the program cannot cope with the stream of data.
The start button starts the monitoring process as you can see in the picture above.
We don't have to generate any additional traffic yet.
Let's select a packet to get a look at the program interface in the upper window we see information
about the captured packets grouped in the columns.
The information available includes sequence number the number of the first packet captured is always
0 the next grow sequentially by 1 the next column shows the time elapsed since beginning of capture.
Often we would like to see this in a different layout.
Frequently we're interested in how much time passed since the previous captured packet.
Sometimes it makes it easier to find some abnormalities
in other columns.
We see the sender IP address the receivers IP address the protocol as long as wireshark is interpreted
correctly and the amount of data and diagnostic information.
Let's see how this looks for an application layer protocol.
For example let's look at the HTP protocol.
After typing a valid display filter we will only see HTP packets from the lecture on the same model
we know that the higher level protocols are packed into the protocol packets of the lower layers.
We can see the Internet frame and at the bottom we can see the whole set of captured data.
The frame contains everything that we would find in the higher level protocols.
When we choose the details of IP version 4 we can get to know the values of the IP version 4 header
fields for example time to live is 64 which means that the package was most likely sent by the server
running under Windows because these systems in the case of the local networks ascribe 64 as the initial
TTL value.
We can also find out by whom and to whom the packet was sent.
Examining one level higher refined the TCAP protocol we see that this is a packet sent to port 80 from
a dynamic port higher than the port 10:24 we can see the sequence numbers and the acknowledgment numbers
that is numbers that allow the TCAP protocol to make sure no data has been lost during the session.
There are also the TCAP Hetter options.
These are the flags which as we said are sent in a strange way during the ex-mistress scan the checksum
closes the TCAP header when it comes to the TTP protocol.
Wireshark analyzes it just like any other header values we get to know that it was a servers 200 OK
response a message confirming a successful client request to try out more wireshark functions related
to HTP protocol.
Let's visit a web site such as you to come from the perspective of a user.
This site gives you an opportunity to view a variety of contents.
Let's see how it looks from the White shirts perspective.
Let's clear the filter field.
If the data is not cashed yet will be able to see the data downloaded by the client.
Looking at a stream of packets it's hard to say what we're actually seeing.
So let's apply some additional features offered by wireshark
in the file export menu you can select objects from the HTP session.
Now we can see that these were some pictures wireshark has a sync option so that everything that's displayed
in an additional window is highlighted in the main one too.
You can even save the pictures that have been captured after the reassembly of the right packet.
You can do the same with other multimedia files.
If you have a program that plays Adobe Flash video files you can watch offline what you've previously
watched on the internet
while exploring other functionalities of wireshark will examine some problems.
Let's start with a classic problem.
We close the window we've been using and start the program with a capture file we've saved before.
Because we're now dealing with the AARP protocol a lower layer protocol.
The analysis is much simpler ARPU converts IP addresses to Mac addresses and vice versa.
There's little data in the error packets the minimum and maximum size of the ethernet frame is specified
if there's too little data to reach the minimum the frame must be filled up programs sometimes fill
up the frame with current buffer content evidently.
This is a network card driver problem.
It fills up the frame with what's in the buffer at the moment.
For example with what the user is last received or sent over a network analyzing the AARP you can find
out what network users have been doing recently.