In the previous video we seen how we can launch wire shark and we said that we can actually just open
and a file that contains packets that we already captured and we can start analyzing them using wire
shark.
In this video I want to start sniffing packets and then generate some traffic in my windows machine
and then we'll see how we can analyze these packets using wire shark.
So I've already I'm already the man in the middle as I said you first have to be the man in the middle
to use wire shark and then yeah the traffic that's generated in the Windows machine is actually flowing
through 88 0.
As we've seen in the previous video.
So before I start capturing the packets I want to go to the options and I just want to show you what
options we can set.
So first you can see all the interfaces that you have and you can see the traffic generated on them
and you can see 88 zeros actually generating some traffic every now and then because it's actually coming
from the windows machine.
So in here you can select the interfaces that you want to start capturing on and you can actually select
more than one interface and all you have to do is just hold the control and then click.
Other interfaces that you want to listen on for example we can just click them like this.
But for now I actually only want to sniff on 88 0 now if we go in on the output you'll see that you
have an option to store these packets somewhere.
So again if you're only if you only want to sniff and you don't want to analyze things then you can
just go on the Browse and you can store the packets that you're going to sniff somewhere and then you
can analyze them whenever you have the time at a different time you can just open them with wire shark
like I showed you in the previous video you can just go on file open and then open the packets and start
analyzing them.
Now I have 88 0 selected and I'm just going to click on Start and that'll start capturing packets anything
that's going to flow through 88 0 will be captured and it'll be displayed in here.
Anything.
I mean images pictures messages cookies anything that the computer does on the Internet will flow through
88 0 and therefore will be captured by wire shark.
So it's not like man in the middle life or it was only shown us the important information right here
you'll see anything.
All the traffic that's generated now I want to go and generate some traffic on the target computer so
we can analyze it here but before I do that I'm going to go back to buttercup and I want to start my
Hage Estes couplet so I can downgrade TTP s to TTP cause if everything goes overhead TTP we won't be
able to see or read anything because like I said everything will be encrypted so I'm going to hit enter.
This will work as expected we'll go back to wire shark and let's go to the target computer.
I'm going to go to Google the Little E and the search for some things so for example let's search for
that security
and keep in mind everything is loading over TTP in here.
So that's why we'll be able to read and analyze everything that we're loading right here now let's go
back to white shark and see how we can filter this information and discover the Web sites visit by the
target see the requests and all that.
So I'm going to click on the start button to stop this.
Now this is the main interface of fire shark.
And you can see that the first thing we have is each one right here.
This is a pocket now you'll see here the columns.
First of all here is the number of the packet.
So you have this one is number one.
Number two number three number four in the time you'll see the time when this packet was captured.
So zero is when we first started sniffing.
And then the time increases as we go down and it shows when these packets were captured when they were
sent basically.
You can also see the source.
So this is the device that the packet was sent from.
And you can see that this one is not sent from our target.
It's actually coming from the Internet from a server that has this IP and it's going to our target computer
which is 10 2014 to 0 6.
You can see the protocol.
So it's DCP for this one.
You can see that it's ICMP in this one.
And you can see that it's a sharpie for this.
You can see the length which is the size and you can also see info about this packet.
Now we can also notice that these packets have different colors.
Usually Green is DCP packets.
Dark blue is DNS packets.
And if we go down with that we should actually be able to find some of them.
And you can see all of these are DNS packets lively usually is UDP but we don't have any UDP packets
at the moment.
And you can also see that we have some black packets and these are TCE packets that had the problems
that had issues.
Now I know what you're thinking.
There are so many packets in here and a lot of them might not be useful to you depending on what you're
trying to get.
But don't worry about this in the next lecture I'm going to show you how to filter these packets to
only display the relevant ones and then analyze them to extract the useful information.