to really figure out and drill down to
essentially what it is you're looking for.
Which again, forces you, and I,
and I wholeheartedly say, forces you
because if you really want to learn and
dig deep into this tool,
you're going to have to really start looking
at how does TCP operate particularly.
Most, if not all of you, may know the handshake.
We'll cover it in a later module for those
that may not know it, but that is
going to be the predominant thing
that when we do a flow graph,
when we pull flow graph to Wireshark,
those are the things that
you're going to need to look for.
You're going to need to see, ok well,
I've had duplicate ACK's.
So what does that mean?
What is an ACK, right?
So those are the things that
will require you to dig deeper
into understanding the protocols. And again,
the different layers of the OSI model.
So, we're just going to briefly talk about
some of the analysis tools.
One of the key things with analysis tools
is that there are many tools
within Wireshark itself.
Wireshark itself has analysis tools within it.
There are analysis tools outside of Wireshark.
There are analysis tools that are handheld
that you can plug in to your network.
There's analysis tools that are
enterprise-wide that require probes
and all the types of devices.
Whatever those devices are, just remember
these tools are, are simply for the form
to help you analyze
what a potential problem can be.
And the reason I put the Expert up here,
which is a tool within Wireshark
and we will have a whole module
dedicated directly to it.
This tool will give you some specific
information, but it will not in particularly
tell you exactly what the problem is,
and, and that's, that's been a concern
for many in the past is
will this really tell me what the problem is.
When I install Wireshark,
well, it'll immediately say -bing-bing-bing.
Here's the problem, you need to do this,
you need to do that. No.
And that's why to start off this
foundation's course, I really wanted to drill
into and get, get some awareness around
the fundamentals of how these tools
are really used and what, what information
you will need to be successful with it.
This tool is going to tell you that a
retransmission is suspected,
and if you really think about it,
what does that really mean to you?
And worst, it's telling you it's suspected, so
that's what the Expert and
other analysis tools do.
They allow you to view things and
do some deeper diving into them.
So what will we find?
We're going to do some deep packet inspection.
We're going to review the data packets.
We're going to look at timestamps.
We're going to look at communications patterns.
We're going to look at a whole bunch of stuff
in the next 2 days, 2 to 3 days,
and really dig deep into this data
and start seeing some specific stuff.
And that should be interesting
to everybody, and exciting.
Because a lot of times, you get
really good at configuring devices,
you get really good at designing devices,
but what's really good is when you know
how to solve problems with them.
Because what we will find is, and, and I
I've seen this many times in the past.
We spend a lot of time, put a lot of effort
into designing a perfect network,
or augmenting it perfectly.
We spend a ton of time looking to engineer
the best solution, the most secure,
the most flexible, one with the most a
and a bandwidth, and one that's
to deliver optimal results.
And you know what winds up happening,
this is what we've seen.
Networks are augmented
and a lot of times the staff turns over
and new people come in.
Maybe it wasn't documented well.
Mistakes are made. And this is no fault
to anybody. This is just how we live our lives
in an enterprise networking world.
Things change. New solutions are put in place.
Sometimes they don't the time to lab them up
correctly or staff with a, they don't have the exact
skill sets needed but they give it the best try.
Sometimes things just go in.
You have other groups.
So, their servers are getting added.
Maybe they didn't turn things off like, you know.
Zero config on printers and
and what ends up happening is
there's just so much stuff in a big network
that the more we lab up, and the more
we learn about the design-build-run
and the more that we learn about Wireshark
and how to troubleshoot and dig
deep into the networks,
the better off we will be to solve problems.
And that is the key to solve issues.
The fire alarm goes off, things are broken,
the application's down.
It's a critical application. People are panicking.
And you come in, very calm, cool and
collected and you strategize
the exact way to solve or fix this issue
and that's what we're striving for.