Hi, good morning evryone.
My name is Rob Shimonski
and welcome to INE’s Wireshark Foundations.
In this course, we're going to talk about
Wireshark networking and a whole bunch of things
that will teach you more about protocol analysis,
packet analysis, network analysis.
And in this course, our plan is to get you from square one
all the way through to understanding how to navigate the tool,
how to capture traffic,
how to analyze traffic and find problems on your network.
My name is Rob Shimonski and I've been in the networking field for about 2 decades.
I’ve been working as a consultant,
full-time employee, trainer, book author,
I’ve done quite a few things in the realm of
networking technologies,
systems administration, data center
and one of the things that I found is that
no matter how many things I’ve learned
there’s always more to learn.
So welcome and thank you for joining
because we’re going to get through a lot of material
and our goal is that you get a lot out of this course.
So without any further adieu, let’s get started.
Alright, module 1...
In this module, we’re going to talk about
Network Layers
and the OSI Model.
Now, one may ask, why do I need to understand so much
foundational information to use Wireshark.
Well, with Wireshark, interestingly
without understanding the fundamentals of networking,
it’s really just a tool or an application.
It’s really what you understand about networking
that’s really going to bring this to light.
So what does that mean?
Well, you’re going to need some fundamental network
knowledge to be able to operate the tool,
to use the tool.
If you are just navigating the tool,
you install, you capture some traffic,
you open it up, all you are going to see is
a ton of information that you may not really understand.
So what we are going to do is we are going to work on
in the beginning
getting you some of the information that you need
to be able to use the tool accurately.
So when you use the tool,
one of the things that you want to do is you want to be able
to do some detective work.
Alright, so let’s say you’re trying to troubleshoot a network and
you have a problem with the particular segment, maybe it’s slow.
Well, when you set up Wireshark and you learn
a capture, all you’re going to see is a whole bunch of traffic.
It’s really understanding what to do, how to filter that traffic,
knowing that you captured particularly data
from one point to the other, that’s really gonna make a difference
of using and understanding this tool.
So later on in the course, we gonna talk about how to install it,
how to build filters,
how to look through the data, find problems with voice,
find problems with slow performing websites.
But before we get there, what we need to do is we need to
spend some time just understanding the basics.
So, the first thing that's very important is
understanding how the data traverse is as a network.
So if you have a client and you have a server
that is a very simple network segment maybe connected by a switch.
So we can start there.
If you have a client that’s accessing a server,
it’s trying to access some type of resource and is performing slowly,
the most important thing to understand about using Wireshark is to know
that you want to capture the data from one point to another,
so we're going to call that source to destination.
When you use the capture which you're going to look at
from source to destination is how that data traverse is
from that source to destination and
you're going to have to understand at least the basics of the OSI model.
When we talk about protocols, we talk about the TCP/IP protocol sweep,
we talk about sending data from one place to another
and how it is encapsulating the data.
The most fundamental thing to understand is the actual OSI model.
And now this may seem very elementary for some,
a lot of people do know the OSI model.
They do understand it, maybe they did the network plus
or the CCNA or in their first foray into this field,
but really understanding that the data travels from source to destination,
when it does that it goes up and down the OSI model and at that each layer
it’s encapsulating the data and adding and appending stuff to the data.
So why is that important with Wireshark?
Well, when you capture the data with Wireshark,
you are going to see in the actual window,
you’re going to see things where you’ll see protocols like ARP,
you’ll see mMAC addresses, you’ll see IP addresses.
Well, understanding that a MAC address can be found in layer 2, the data link layer,
understanding that the IP, IP address
with the routing will be down at layer 3, the network layer.
That’s the fundamental information you will need to understand
to use the tool is understanding the basics of the OSI model.
So, when you're learning Wireshark
what’s good is that, your, the segment or
the lab segment that you're going to work with
unless we start adding firewalls and load balances
and those types of things which we will explain in future modules.
Basically the understanding of how data traffic,
traverses the network from source to destination,
going through layer 2 and layer 3 segments is
is probably the most common scenario that you’re going to be trouble shooting.
So another key element is actually how to capture traffic
and again in the future module we will talk
about how to actually span a port,
how to get that data captured. But what’s important to understand now is
if you just played around with Wireshark in the past,
maybe downloaded it, installed it, that’s basically installed on an endpoint.
Now, there’s different ways to do this. You can run a tap, you can hub out,
you can do a bunch of different things but the 2 most common scenarios
that you will see when you try to capture data with Wireshark will be
you will either install on the endpoint which will probably be the source
PC or client and the destination server,
and you will install it locally on the system.
Another way you can do it is to do a port mirror
which is actually coming through the network
spanning a port if you have a CISCO switch,
you can run a port monitor and you can send the traffic from either of these,
the source or the destination to a second port,
where you can capture the data on let's say, a third machine.
So why do you use Wireshark?
Why are we going to set all these stuff up and go through all this work?
So what Wireshark does essentially is help you solve problems.
Now, one of the misconceptions is is that by installing Wireshark
and looking at it, it's going to tell you exactly what your problem is.
Now in some cases it might. You might open up
the Expert and it might give you a close enough clue
or you may see something very obvious in the capture.
But what’s really important to understand is that
you have to do some detective work and you
have to know a few things about networking,
systems administration, and here’s a good example.
Let’s say, you have a problem with a slow performing network
or what was called a slow performing network.
Now most of you, if you’re in the field, you probably feel this pain,
everything comes up as a networking problem.
So the server could be very slow and the tickets get opened
and the escalations start and they’re saying,
"'Why is the network slow?"
End users do this predominantly and it’s interesting how
through the years they’ve learned enough to say,
“Hey you know what, my application’s not working correctly, the network slow.”
So a lot of what we do is to rule out and to isolate what the exact problem is
and Wireshark is a great tool for helping you do that.
So, yes you are going to do some other things, you can run a ping,
you can run a trace route, you can look in your router logs,
you can look in your switch logs, you can look at the server,
let’s see, it’s a Microsoft server, you can look at event viewer,
you can look at performance monitor, start looking at the I/O on the box.
There’s a lot of things that you can do and it’s recommended that you do that.
So using Wireshark is a part of what you’re going to do to trouble shoot problems
and Wireshark is predominantly going to be used to capture the traffic,
to look at the packets and note exactly what’s going on
because you will find a lot from those data packets.
You’re going to use Wireshark to review the traffic on the network.
You can look at the protocols that are in use and the traffic flow.
So, as an example again, one of the things
that you might find is you might find that
that someone's saying the network's slow,
and it could be something else.
It could be that you're trying, your client's trying to access a website
and let's say, there's a problem on the web server,
but what you might also find from the
traffic capture is you might find
that there is a lot of extra traffic on your network.
So, you may find a lot of multicast traffic
you weren't aware of, you might find some
printers doing some multicast.
You might find quite a few things that
you would then be able to note on your report
after you capture and say, "Listen,
we found a problem with x,y and z, but
we also like to recommend that
you know maybe we'll look at these other areas
and try to solve some of these issues as well."
So as we were talking about before
one of the key things with troubleshooting
with Wireshark is to understand
what you're going to be doing with it.
So in the graphic that I have up,
there's a simple network design.
It’s a very simple network segment where you have
a client accessing a server through a switch.
It could go to a routed segment.
The switch maybe a layer 3 switch
but one of the key things I wanted to point out here
from what we talked about before is
installing Wireshark either on the endpoints where
you would install Wireshark on both
of these computers, the client’s as well as the server.
And or, you could install Wireshark
just on, let's say, the laptop that you see
span a port from the switch and
send all the traffic to that Wireshark so that you can analyze it.
One of the key things that you want to remember is
when you're troubleshooting, you may not
be able to install Wireshark on the target machines.
And that's because maybe they're not capable
of taking Wireshark. They don't have enough
system resources, as an example,
and or, they're doing work.
Maybe there’s a policy that says,
we cannot install this on the server.
So just be aware that before you do install Wireshark,
you need to be aware of some system requirements.
We will get to that when we discuss how to install Wireshark
but just remember for starting off here in this module
where we're just going to talk about the basics of,
you know, you have a simple network segment,
you want to install Wireshark on the client’s
and then the destination server to troubleshoot the traffic,
and or you can install it on one machine
and send the data through a span port to a target.
Alright so, just to close out the topic on the OSI model,
again, it’s important to understand that
when data traverses a network,
and it goes from the source client to the destination server,
there’s a lot of things happening here.
So at Layer 1, is generally where you’re not
going to be looking so much into Wireshark.
That’s where the electrical signals flow
through the wire, the cable, the copper,
the fiber and or the wireless signal.
And then more so, you'll see, layer 2 through 7 where
the data is being encapsulated,
or being stripped, decapsulated and
what you’re going to see from that capture,
when you capture with Wireshark is that
addresses may or may not change.
So you have to be aware of that.
For example, when it goes through a swtich
it’s likely that the addressing
it's not going to change but then as
it's being sent from router to router,
it's going to change things, right?
So, you’re going to have to be aware
of your network topology.
You’re going to have to be aware of
when it traverses a firewall, for example, if it's doing natting
then you’re going to have to be aware of that
because if you just installed Wireshark on the server,
you may see a different set of addresses
coming to it in your capture,
and you may not understand what that is.
So understanding as much about the network
and the OSI model and how the data traverses
the network is going to be key to using this.
As well, when you capture data in Wireshark,
you're going to see things that
reference ports, a lot of you
I'm sure are aware of what a port is.
Essentially, in Wireshark
there is a services file
that does the most commonly known ports.
We all know IANA.org, the assigned port numbers,
so you can actually modify this file
for some not well known ports to customize it.
We’ll get into that in future modules.
But just be aware
that a lot of things that you're going to see
in Wireshark when you capture your data
will be in that capture window in the packets pane list
and you're going to see things such as
the ports, the IP addresses and MAC connections,
MAC addresses, the connections
from source to destination
as well as the data encapsulating and decapsulating.
So when you look at the actual connectivity
when you're installing Wireshark,
Wireshark is going to use something called WinPcap
and that's going to go in,work with your NIC card
to supply the driver with the ability
to interface with the API
through Windows if you use it or with
Bcap if you are using Unix,
and that’s going to allow your NIC card
to be set in a promiscuous mode
which will allow for the data, all the data
to be captured and collected by Wireshark.
Otherwise, it’s only going to collect
what's destined for the machine.
You’re going to have to be aware of ports
for example, when we’re talking about port mirroring.
You’re going to have to be able to span or
mirror a port, put the port in monitor,
and you’re going to do that in a CISCO switch,
you can do that in a Nortel switch,
you can do that pretty much in most switches
but just be aware that you might have to configure
a port to do that, that type of connectivity.
And then other network interfaces are
probes where, for example if you're not tapping,
if you're not configuring a port,
if you’re not installing on an endpoint
and configuring the NIC to work in promiscuous mode,
with higher end tools, enterprise tools such as
Riverbed Cascade, ARX, Net Scout, and Genius.
You can use probes that will view
the traffic as it's traversing the network.
It’s going to look at the network
passing and will be able to collect and
allow you to view it in an enterprise tool such as those.
Other hardware to be aware of, obviously
we already talked about switches and routers,
we mentioned firewalls briefly,
IPS units, load balancers.
Just be aware that when you're
troubleshooting and you’re capturing data with Wireshark
and you’re only from source to destination,
it’s important to remember that these devices that
it traverses, it’s going to change the network
data that you see as you capture it.
And you need to be aware of these devices
and have a fundamental knowledge of
how they operate because for example,
with the, with firewalls as we already mentioned,
if it’s blocking traffic - a very good example
of not being able to troubleshoot an issue is
when you go and you configure Wireshark,
let's say, on a server in a DMZ
and you set up a Wireshark on a client,
not in a DMZ and you're trying to figure out
why data is not traversing,
it’s likely that an ACL is dropping that traffic
and it’s quite possible that
by looking at both captures, you’ll be able
to find and see that the data is not
going from source to destination.
So you just need to be aware of
the network hardware that is on your enterprise network.
So one of the things that Wireshark also does
is allow you to not only look at protocols
and look in the packets.
You've heard it called a protocol analyzer,
network analyzer,
a packet analyzer, a traffic analyzer
That's because it pretty much does all of those things
and when you're doing each one of those things
you can reference Wireshark or a tool
such as that in that means.
You could say, "You know I'm looking at traffic,
I'm using it as a traffic analyzer."
And some of the things that you could do
when you capture the traffic
is reveal some of the issues such as,
you may have bandwidth issues,
you may have corrupted data,
you may be taking an incorrect path,
path maybe having a synchronous routing
problem, data may be latent.
There's many reasons and just
some of the background information of
Wireshark being helped, used to help solve those issues
is you may see a lot of a TCP traffic,
a lot of handshaking where
there's a lot of reset packets.
Why, why would that be happening?
You may see things where
there's a lot of retransmitted packets.
So now if you understand TCP/IP
which we'd get to future module
to discuss a little deeper,
you may see that the data restransmiting which
is just fine because that's
essentially what it's supposed to do but
very often why is it doing that -
you may have a problem on your network
where it's getting choked and that it may have
to continuously resend the data.
All these things you can find with Wireshark
when you capture the data.
And again just remember source to destination
data is commonly captured and analyzed
from a source to a destination.
That does not mean again and
this is very important to understand that
you're just looking at that data.
You may want to log into the router,
you may want to see,
you know, what the process is.
Or you may want to see
if the buffers are getting jammed up.
You may want to look at a lot of
different things because
it's all one big picture.
If you were just looking let's say at a
a very simple segment, then
the amount of detective and analysis work
that you have to do maybe limited.
But when you're troubleshooting
on an enterprise level network,
if you're trying to figure out
something in a CCIE lab,
you're trying to figure out something,
why a production system is completely failing
in a DMZ, there's a lot of things that
you're going to need to look at
and it's not just limited to Wireshark.
Wireshark is just a tool
that will allow you
to perform a deep set of troubleshooting
analytics to allow you to
peer into the data
and get more, more information.
A great example would be
in a MPOS network
you may want to find out
what data is traversing.
You may need to take a look at the labels
that will be very apparent to you
when you capture the data.
Look at it in Wireshark, you sort it
and you can figure it out by filtering
through it and seeing exactly
where things are going and why.
And if it's not going there
perhaps you may need to look at
in the network, a routing problem.
You may need to see if something is
getting dropped somewhere
So those are good examples of why
you would really need to focus
with Wireshark on source to destination,
multiple sources to multiple destinations,
but remember the foundation of
where you're starting from,
and where you're going to,
where you're going to put Wireshark,
how you're going to capture the data...
You want to recreate the problem, right?
You don't want to just install Wireshark
and, and you know, just run it.
You want to run Wireshark
and try to recreate the problem.
Maybe have a baseline of how it operates.
It's normally to compare against.
So these are some of the key elements.
And again with data encapsulation,
what you're going to be looking in Wireshark is
you're going to see the data encapsulated.
So for example, if you're just looking
in a layer 2 problem,
you'll see it encapsulated in ethernet.
Right? So, generally as our profession
moves into the future
you're not going to be looking at
the things with token ring really much anymore
even though you can use tools
to sniff out and find problems with it
but you're mostly going to be, you know
concerned about ethernet,
TCP/IP and that kind of stuff.
But from encapsulation point
when you're capturing data in Wireshark
you're going to be able to see particularly
the header information,
and you're going to be able to see
when you capture it
what's under the hood.
You're going to see details to be able
to solve these problems.
And when you look at the actual data
and this is in the details of a packet,
you'll be able to see
the encapsulation type ethernet.
Ok, well that's really good.
because that's very simple
and it's the first type
of things that we would look at
but more importantly,
we would be able to see things like
what's the frame length, what,
is it having issues, something with FCS.
You'll be able to see these things
as you're digging through your capture
and looking through the network.
Alright, so as we wrap up this first module
some of the things that we want to cover is
when you capture data,
you want to inspect it for issues,
you're going to be doing
some deep protocol analysis
you're going to be looking opening up
after you capture the data
and you're going to inspect it.
We're going to do things such as like
pre-capture filters, display filters;
we'll be able to write expression,
and then we'll be able to really drill down
into the data that we want to see.
But just remember, at a very high level,
we're not going to be able
this stuff without Wireshark.
There's tool you can use for example
on an ASA, you can,
you can run a cap and you see data.
There's other things like fluke,
has some tools that you can capture data with.
But just remember with Wireshark
in particularly,
it's going to open up the captured data
and allow you to see very deeply within it,
filter on it in a GUI and at the command line.
It will also help you do
traffic analysis, network analysis
that you could find key problems
with your network.
Remember, you're not just going to use Wireshark,
your fundamental tools will still apply.
You'll still want to run a ping,
a path ping, a trace route. Look in router logs,
look at router, routing tables, switch logs
firewall logs, the actual system itself.
Run the performance monitor
or run it, look at the processes on the Unix box,
see how healthy those systems are.
All this is going to play
in your overall traffic analysis
and that concludes module 1.
One of the things that we want to do is
we want to make sure
that with everything that we're doing
we look at Wireshark as a tool.
We want to make sure
that everything that we look at is not
in a way where we're going to look at it
Wireshark and say Wireshark
is going to give me the specific
problem that we're seeing,
it's going to tell me what the problem is.
Just remember, it's just a tool,
it's an extention of your experience,
it's an extention of your knowledge,
and you'll always be learning.
So just remember that, learning Wireshark
is a lifetime event as the networks change,
as technologies change,
so that's what you see with Wireshark.