HakTip - How to Capture Packets with Wireshark - Getting Started Video

welcome to hack tip the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today in celebration
of all things Shark Week I'm biting in
to some Wireshark now Wireshark is a
very powerful and popular network
analyzer for Windows Mac and Linux it's
a tool that is used to inspect data
passing through network interface get
your Ethernet LAN or even wireless radio
the series of data are considered frames
of which include packets Wireshark has
the ability to capture all of those
fishy little packets that are sent and
received over your network and it can
decode them for analysis when you do
anything on the internet like browse to
different websites use chat IRC transfer
files what have you the data is always
converted into these packets when it
passes through your network interface or
your LAN card Wireshark will hunt for
those packets in the tcp/ip layer during
transmission and keep whatever it finds
it's important to keep Wireshark in mind
if you're a network admin who needs to
double check that all of your customers
sensitive data is being transmitted
securely very very important on the
other hand you might want to watch out
for those sharks that are using this
tool on open networks or your company's
computers and steer clear of plaintext
protocols like HTTP also very important
consider using HTTPS Everywhere I mean
everywhere like no matter where you go
on the Internet's use HTTPS very
important or encapsulating your packets
in a secure SSH or VPN tunnel they're
like shark cages for the internet after
the break let's boot up Wireshark and
we'll see how it works we're back now I
already downloaded Wireshark and I got
to open it up in Linux so I type in GK
pseudo Wireshark
Center typing my password and it opens
up wireshark so pseudo GK pseudo
Wireshark in terminal basically means
pseudo for graphical applications
Wireshark in this example now I've
already installed Wireshark I've started
the application under the capture SEC
section right down here capture you'll
see you can choose that the the device
that you want to sniff at the top of the
application is a button called capture
options where you can customize all your
different captures and this looks like
the little icon right here show the
capture options total all this now if
you go back under interface list right
here you'll see that one of your devices
is actually sending and receiving
packets you can double click on
interface list and it'll pull up a nice
little list showing when actual packets
are going in and out now I'm going to
jump on my browser just to test out
where packets are going and what they're
doing so I'm going to click on my blog
and then go back over here and okay so I
can see that wlan0 is my general my
interface that is being used most often
so I'll click on that one that's your
active one over here you can click on
options and you can customize stuff to
your liking if you click on it you'll
see different options such as capture
packets in promiscuous mode or capture
in monitor mode you can also do display
options like update your list of packets
in real time which is for my example
necessary so I after I choose all of my
options I click on start and it should
start capturing all the different
packets that there that are going on in
this interface Wireshark is going to
take you now to a new pane that'll show
you all the packets that are being
captured by Wireshark to gather some of
the data we're going to fire up our web
browser which I've already done and I'm
going to swim on over to Shark Week comm
let's see what happens when I go over
there sure
we calm okay so I got this going I go
ahead and pause that lets pause that
don't too much going on there we go okay
so we can see tons of packets being
transmitted right now so I'm going to
click on stop stop running the live
capture because we have plenty of
information in here that we can look at
you can scroll through this really long
list of packets in you can find
something that looks interesting there's
a lot of info here so let's start with
the columns the first column on the very
far left over here number is obviously
the packet number the second one is how
many seconds it has been since the start
of the capture so time right here format
it as specified and then the third
column is the source IP address the
fourth column shows you where the packet
will be sent the destination IP address
and the fifth column is the protocol
that sent the packet
this can be DNS for domain name servers
TCP for transmission control protocol or
HTTP for browsing for example the last
column will show you a little bit more
information about what's going on during
this whole packet capture now since we
have a whole bunch of data collected
we'll want to filter it so let's look at
just the HTTP requests to do so go up
here to this little filter bar and you
type in HTTP dot request and you can
just press ENTER once you find it
there we go and now we have a nice long
list of all HTTP packets of interest and
we can right click on one that you want
to choose and you can select follow TCP
stream so I'm going to find one that I
like this one at the top looks good
converted in Shark Week HTML blah blah
who knows what all that means so I click
on it and I get even more awesome
information you get all the raw contents
so here we can see what I sent in pink
and Discovery's response in blue kind of
interesting you can see I am looking for
discovery.com and then it redirects me
moved permanently to discovery.com to be
/r week ha very cool now did you guys
catch a lot of packets today using
Wireshark
tell me about it in the comments or
email me tips at hak5 org and be sure to
check out our sister show hack 5 for
more great stuff just like this I'll be
there reminding you to trust your techno
list watch out for the Sharks