Not we've installed wireshark the next thing you do is take a few minutes and talk about working with
worker mainly the user interface.
This is how you're going to interface with the program and actually interact with network traffic.
So what we're going to do is we're going to explore this we're Asharq interface we're going to look
at the different components of it and how you can access different things to analyze your network traffic.
We're going to start with a packet capture.
This is going to be our actual static file that we're going to present to you an aesthetic file is going
to allow you to look at different network traffic and learn how to analyze that packet capture that
we're going to examine the window sections.
There's three main window sections work.
You can learn each one of those one two sections and ways you can do to enhance your analysis of the
network packets that you capture on the wire.
We're going to identify some resources to assist.
That is where can we go from here.
So we have more material into course but also places you can go and learn more information about this
wonderful tool.
So this is the actual wireshark interface.
So when you have a look here you see we've got Welcome to our show.
And under there you have the network adapters.
So as you look at this image here you see these network adapters the wireless network connection actually
has a graph on it that shows you that the wireless network connection is currently capturing packets
on the network and all we have to do is double click that or click on capture and start our capture
and we'll be able to actually identify that.
So we have two methods to start our packet capture.
We can use the menu capture select options select start or you can just double click and network adapter
of your choice.
My preference is to use to capture the options in the start.
And this is actually what comes up when you use Capture options and start it.
See here we have all our interfaces I have the wireless network connection selected here.
What we do is we just click on start once we click on start we'll start capture in packets.
Let's take a look at it.
So there's three main sections of the windows.
We had the packet list as you see here in the image this packet list is showing you the source of the
packet the destination of the packet.
So it starts in the far left corner with the number and then self-explanatory the number of the packet
in the trays then it has the time number of seconds ticked off between the packets the source.
In this case we have a Netgear source and then this destination is the broadcast address.
So in this case it's going to our network broadcast address and this is address resolution protocol
which is just basically asking who has this address tell me and we'll look at that more details as we
expand and learn more about TZP IP and how to conduct analysis a TC VIP traffic Nanda package details
which is located in the middle window.
This is where we get into the actual furriner.
So you see you're on the actual image.
We have the frame encapsulated inside that frame is Ethernet traffic and inside the ethernet traffic
we have address resolution protocol.
This middle windows where you expand and to look at and view additional details of the packet thing
that we call the header which we'll learn more about as we continue and build your skills.
The next one is packet bytes.
This is in the bottom Moz window.
And as it says this is the bite's is usually represented in hexadecimal.
So it's easier to look at than binary bits of ones and zeros.
So if you look at this we see this packet bytes has these Efes those six sets of efts means broadcast
address.
So now we're just looking at a broadcast address in the actual packet header the self.
Now what you see here in the bytes is the destination comes before the source.
That's something we have to look at as we get more and more detail of how to do packet analysis.
So help us some resources for you.
Wireshark user guide is an excellent resource.
This is where you can go you can get information about wire share.
It has detailed information on how to use the wireshark tool including sample packet capture references.
You have the weiqi.
So if you go to a wire shirt dot org and you select the Weiqi That's an excellent source and a resource
for you to follow.
Shark fest is this annual wireshark conference that has all these great presentations and conference
talks and workshops and how to use wireshark and even more detail.
So again all these will help you learn more about the harsher tool as we said resources and references
will help you become a wireshark expert.
So what we cover in this brief section of our module we look that the user interface for work that is
we saw there was two main ways to start our packet capture.
We could double click the interface or we could do from the menu option.
We also explored how to start a packet capture.
This is once I start a packet capture what I have to look at Zahm into Windows sections.
We have three main sections within the wire Asharq interface.
We looked at each one of those we had to packet information packet details the packet bytes and more
information that we'll look at as we get more and more deeper into our information to Tauriel.
And we identified some resources to learn more.
We talked about the excellent wireshark user guide.
We talked about the concepts of how you could go to the weiqi and you could actually research information
and weiqi.
And finally we discussed the excellent resource and reference of shark fest.
Maybe you want to attend the shark fest or go just look at the information the shark fest site and read
about the conference talks and presentations that are presented there by some of the top tier talent
within the wireshark community.
So now that we've done this the next thing we're going to do is apply our skills.
We're going to apply the skills we just learned and actually use wireshark to analyze our first packet
capture.
Next we're going to examine your first packet capture.
When you use this excellent reference we've already looked that of how to actually start up Wireshark.
We're going to start up a static packet capture file and you're going to learn how to use these three
main sections of the wire Asharq interface to analyze and get additional information on Wireshark.
As we look in network traffic and analysis of that traffic and this concludes this section.