Hey, welcome back.
In this section of the Wireshark Foundations course,
we will be talking about UDP and TCP streams.
So, just to refine what this is because in the next section when we start going over
troubleshooting specific applications and how they work,
knowing how to work with streams will be extremely important.
To be able to quickly pull the information that you need,
you're going to see a lot of different packets and what you really going to want to do is
you want to drill on the entire conversation so that
when you're troubleshooting something
you could see exactly from start to finish what's happening.
And when you follow the streams, it will give you a higher level of view of the data
such as the application layer of the OSI model.
Streams allow you to pull an entire conversation from the captured data.
If you, for example, wanted to view telnet, or FTP or any kind of TCP based protocol,
and you wanted to see the entire thing, telnet is a good example.
Let's say you were telnetting from your workstation to a Cisco router.
Yes, we should be using SSH.
However, in this example, we used telnet because
with IPV 4 protocols, that information was sent in clear text.
So what I could do is I could know I could filter for TCP, I could filter for telnet,
and I could filter for the IP address source to destination.
But then when I right click it, and look for N go to the TCP stream,
I can quickly pull up in that window specific data that's very important to me
such as the entire conversation where I may be able to glean the credentials
of what it is that you sent when you try to connect to that device.
This is a, obviously a security question, a question of security
because this is one of the main reasons why most companies have a policy of not allowing
a protocol analyzer to be run on their network.
Unencrypted mail, unencrypted attempts at logging into devices, SNP information,
is constantly traversing the network. And if it is not encrypted,
you can quickly follow a stream and find that information within it.
As an example, we're just going to take a basic stream and when we look within it
we can basically what website you went to, why you went to the website,
which you did, for example, you were getting something,
things that were sent back, the posts.
If there was any other transmission, it will be found in the conversation.
So that's a question, or that's a consideration for security but when we go
to the realm of troubleshooting, it shows you the entire picture of activities.
So, someone was saying, I was trying to go somewhere and
do something and there was a problem,
you can quickly look at the entire stream. Here, you could see the TCP stream.
And you can start to put together what could have happened.
For example, you may see a 44 error or 500 error or some type of page error.
That may indicate that there's an issue with the webserver
and you have been quick, you've quickly been able to find this out by using the TCP stream.
You can also use UDP streams. Very commonly used with OSPF updates,
multicast data, DNS queries. There's a lot of things that we can find
by reviewing UDP data, specifically the UDP stream.
And it will also allow us to view the entire conversation from start to finish
based on what it is that we want to look for.
And in this case, we were looking specifically for
some DNS queries, some email activity was taking place and it was a query.
And it failed and therefore, email could not have been sent,
and we were able to see the entire conversation from source to destination.
Everything that happened as well as the failure within the stream
so that we can, more closely figure, see and then figure out
and isolate to root cause.