Now we've discussed the theory for client server communication.
We will now apply our knowledge and skill to the static capture file that was created file one pre-cap
in G.
You can open the file to follow along and complete the steps as I do.
Or you can watch first and then do it when you watch it again.
So we just click on File Open and we find our file 1 pick up Angie.
So once we open it it will open up and you see here we start off with packets and on the left column
you have the numbers and we got all this ARP traffic.
But before we get into that want to do we want to look at our DNS remember DNS domain name server takes
our name and converts it from human readable form to machine readable form which of course is binary.
So we want to do is we want to go down here to where we find some DNS traffic and we'll go through this
several times.
You get to look at it quite often.
So it we'll show you quick the ways to do this.
For now we're learning the basics.
So what we're going to do is we're going to look for a specific packet because I've researched this
trace R-rating.
So now I come down here and here's the packet I want this 1 0 9 3.
So as you see here we have w w w w DME dot com that's the DNS query for the UDMA Web site and then the
middle window you see here we have a source port which is greater than 10:23 and we have a destination
port which is 53 which is what the domain name server or DNS resides on.
This points to the fact that clients normally use a poor grader and 10:23 and the service is less than
10:23.
Next they want to look at the DNS information itself.
So we click to expand this section that is called the domain system query and in the CLEARY It has a
question and that question is exactly what you probably think that question is it's w w w that you Dimi
dot com.
So we look at this question we see every day that you do Mediacom That's the question.
Going to the server.
So what we want to do is we're going to actually look at the actual queery we have that we got what's
called Taipei for address record and classes an internet record.
So now that we've looked at the query What do you think we want to look for next.
The response.
So in the very next pocket which makes it easy.
So now when we look at the response we see that the only differences located at the bottom there's the
queery but in the response we had this answer and the answer comes out and gives us WWII you D-MI dot
com is at this IP address.
You can see here this 1:51 that 1 0 1 that 24 that 175 five that is the IP address of the Damie server.
So now that we have that that is actually replaced in our browser transparently to us but it's replaced
in our browser and now it goes out and connects on that IP address to the server that's located there.
They merged with the IP address is what the machine needs to get it to the correct location.
So we returned our top window we see right after the response which created the machine readable form
we'd go into a series of connections to this port 80 and we'll discuss what that is in the future.
But right now just understand that's a request to that web server to talk to me.
And that's really what the main thing is.
So now that we have this we want to look at things Apple are the address of resolution protocol.
Now our is local.
So we'll not see the arc for the DME server but we have a number of our packets we can review if we
enter our file locate packet number 37 0 8.
So we come down here page down and we look for packet 37 0 8.
Will teach you a quicker way of doing this once we build your skill set.
But right now we're looking right there and we see impact 37 0 8 the source MAC address is coming from
a machine and the destination address is represented.
All these efforts these efforts of the broadcast address.
And you see it's basically a question who has 1 9 2 1 6 8 0 0.7.
Tell me when 92 when 68 0 1.
So what you see this you know that packet 3 7 0 8 to request whereas in response the responses here
packet number 3 7 1 4.
As you can see here 1 9 2 1 6 8 0 7 is at MAC address in the hexadecimal again.
CC 3D 8 2 1 3 5 1 for f.
Now we have the physical address and now that machine can receive data.
This information for the packet are up.
We click on this as you can see the middle window now has address resolution protocol.
If you look here there's the MAC address.
Now it tells you the IP address and the target MAC address.
Now we have all this information that we've analyzed just in a couple of simple clicks of.
In looking in the tool wireshark as we said it's much easier to represent the IP address in hexadecimal
because we go here.
There is the target IP address and numbers but rather than look at in binary we have it here sees 0
8 0 0 0 0 or 1.
And this section you verified how client server communicates and how DNS and our network traffic look
like we're Asharq.
One important thing to note here is that the entire process we have discussed ARP and DNS by default
and in accordance with the protocol do not have any authentication.
So the source of the packet is trusted to be whom they say they are.
This is one of the biggest reasons we have all the attacks and all the hacks and the things you hear
about in the news today continues to be that the protocols all are based on what's called the principle
of trust.
Now the newer ones that were started to add to and stuff like that is changing that.
But the hackers today still can use this principle of trust to their advantage when they conduct their
attacks.
Next up we will look at your first protocols and this concludes our introduction into client server
communication analysis.