Start to work a short program once it opens verify your interface that's connected to the Internet is
listed in my example here.
This is the wireless interface.
Once we've done that we click on capture options and as you see here we have wireless network connection
and it's even got some data on it.
As you were present with the traffic in the bar graph.
Now what are selected by interface click options.
When I want to do is make sure this name resolution is turned off.
All right.
We want to make sure there's no check mark in his resolve MAC addresses.
Now that's on by default.
So if you haven't done this yet if you do your packet capture you will see the vendor name instead of
the MAC address itself.
We want the MAC address here.
Once you've done that now we click on start.
Now it's capture in packets and if you see it start showing MAC addresses and not the vendor names which
is what we want.
OK so now we want to do is go to a Web site so you can open the browser of choice.
I'm going to open actual Firefox and go to Dimi.
Now that I went to you demean I go back to my work shark and I will capture stop.
Now what I want to do is start looking at the skills we've learned so far and locate the DNS query for
me.
Once we have found that then we can look at the connection.
So where do we have the DNS query.
Well it's a little bit of a process but usually the quickest way is to just and we'll show you another
way later.
And here it is packet 1 0 6.
Now the reason we want to do is because you see the query and immediately we find a response.
All right well once you get to query once you get the response the right here starts that TCAP connection.
Now there's some DNS stuff that happens in between here.
Unfortunately that's what happens.
Anytime you go and open a browser because so many people are connecting and doing different things on
your network.
But he's just see here is it's going this second packet it's going to port 443 which means you D-MI
is using a GPS protocol instead of 82 p.
So the data is encrypted.
So let's see what happens when right click does send packet.
Now remember all the data is in what's called a stream.
So if I right click this and go follow TCAP stream there's all the data within the stream you know the
data is encrypted.
We can still see some of the information that's taking place like we can see this signature here of
global sign cloud SSL secure sockets layer California San Francisco.
So we got different things we can pick up as we look down in here and there's a lot of different things
to look at.
But again this is encrypted.
So I would rather hear as we start out look at one does not encrypt it's what we do is we closed this.
Click on capture start another capture continue without saving our packets again it's going to start
to capture at the same place we had before and now we're going to go back to our browser and we're going
to go to four dot com
I know from research for Jews and Dupee and not 1:52 P.S. You can use any of your own Web sites to experiment
with.
So once I've connected to the Web site now what I want to do is go back to my packet capture and stop
at and then I go to look for the DNS query.
So we go through and we get a lot of data a cable modem here is making lots of noise this morning.
Right here to read up for dot com right there is the query right there is the response and there's the
send packet a three way handshake.
Now since it's not connecting to port 443 we're connecting to port 80 which means it's in a CTP Hypertext
Transfer Protocol not encrypted.
So now if we right click again all our data is represented on the network in streams.
So now if I right click it and I will follow TZP Stream.
Now we can see information here.
Here's for dot com which I typed in because remember the actual client and the client are represented
inbread and the servers are represented in blue.
And you just see a lot of good information in here.
See here it's setting up a cookie and I am in Palos Verdes Peninsula in Los Angeles County and it's
picked that up and said a region code cookie on my machine which is again why so much data mining takes
place on the Internet.
And of course there's ways to get rid of that.
That's another topic.
All right.
So we don't have the type of server we're connecting to.
And that's a good thing for security.
A lot of times we're actually pick up the server that we're connecting to.
In this case there's no server leakage.
So in this case the people who set up this web server has done a pretty good job because there is not
anything that I can detect as a type of web server which is information leakage and we don't want to
leak that type of information with defense.
We want to leak as little as possible.
Now one last thing we'll look at here before we close up this section right here.
I can select different options if I just want to see the server.
I just click on this drop down here I'll show you again highlight the area code blue which is a server
which is usually represented by an address.
It's not a private address my address is the one 92 was 68 address.
And then when I do the other one this is the client.
So again this is all the information that's taking place from the client.
And you see here the user agent those types of things identifies that in fact they use Firefox and I'm
using Firefox version 43.
So again now that you understand how this works you've done your first live capture.
So now you can capture anything on a network and analyze it and detect or determine what is taking place.
And that's the power of protocol analysis using Wireshark.
Next up we'll continue with more hands on protocol analysis with wireshark.
We'll give you even more skills to look at the data.