Wireshark 101: How to Wireshark; Haktip 115 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by citrix gotoassist the number one
global market leader in remote support
welcome to hack tip the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are starting
a short series on Wireshark because you
guys wanted to see Wireshark so
hopefully by the end of the series
you'll understand most of the basics of
Wireshark and be able to solve some many
many problems now if you're thinking hey
heck v you've already done this well
you're right kind of we have used
Wireshark in the past for several
segments probably like tens of thousands
just kidding we don't have that many
segments and I also did a short intro
video about it on episode 64 of hack
tips so go back and watch that one if
you want to check it out real quick but
now we're really going to delve into
everything about Wireshark so first off
a little bit of review Wireshark is a
network analyzer for Windows Mac and
Linux it's a tool that's used to inspect
data passing through a network interface
and it can be your Ethernet your LAN or
even a wireless radio this also includes
things like
sdrs yeah so cool now these bits of data
are considered frames or they include
packets Wireshark has the ability to
capture all these packets that are sent
and received over your network and
decode them for your kind of analysis so
it can help you fix problems these
packets are made of all sorts of little
bits of data everything from you know
little bits of data about TCP protocols
to http or everything in between now it
can have your browsing history in there
if that's available over HTTP it can
have key logs from an IRC session if
that's not encrypted now Wireshark can
find all of these different packets sent
over all different protocols including
TCP IP HTTP UDP and all sorts of other
ones and it's available for free to
download over at Wireshark org now for
this series I'm going to be using
Wireshark on my Windows 8 laptop which
is an Acer Aspire s7 it runs pretty much
the same on all the other operating
systems so just use whatever you have at
home and on today's episode we'll start
looking at the graphical user
yay and we'll introduce you to what the
heck a packet capture is so firstly when
you open up Wireshark this is what
you're going to see behind me there's a
couple of tools at the top and a little
area called filter we'll get back to
filter in a little bit but first I just
want to run through a few of the generic
terms that are involved on here and
there's a few boxes below in the main
window as well so you'll see capture
files and online so I'll start with
online this just gives you a link to the
website for Wireshark it also gives you
a really really nice user guide it's
very very descriptive so and it's also
really long very good user guide and
there's also a lot of information about
the security of Wireshark so for example
a lot of people might be concerned about
what they're sharing as they're using
Wireshark and this will kind of branch
it out for you now under files I have a
couple options here as well you'll find
open which just lets you open previously
saved captures and then sample captures
if I go to sample captures this is kind
of cool a lot of people have actually
shared different captures on the web
that you can download to kind of get an
idea of how it works so if I wanted to I
could download this one called DHCP dot
pcap pcap is a packet captured so once I
download that I can go over here and I
can go to open and just scroll down to
wherever DHCP dot pcap is and then I
could open that from here and it'll show
me that entire packet capture now I'm
just going to close it so I can go
through the rest of this menu for you
now over here is information about
capturing so that this is the last
section on the main screen this is going
to let you choose your interface for
example if I click on interface list
you'll see all the different interfaces
that are available on my computer right
now I'm connected to Wi-Fi so that is
the one that's currently getting packets
back and forth it'll show you the actual
packets and the packets per I believe
that second you can also click on
details and this will give you a whole
bunch of generic information about your
specific interface so for my wife I want
I get like the operating system that are
using and the different media that is
supported such as Ethernet
or Wi-Fi or whatever the Mac ID and
things like that now I can go ahead and
close those and then under that you see
a little button that says start so this
is how you can start your packet capture
you can also choose interfaces
underneath there as well and then
options the capture options right here
this gives you a nice big menu of a
bunch of different customizations that
you're allowed to do so take a look at
your different capture options and here
you're going to find things like a
filter a capture file and even more and
then under capture help here how to
capture I can click on this and it gives
us a nice outline of how to capture
information in Wireshark if I go back I
also have information on network media
so this is going to give you a nice
little outline of what operating systems
will use what interfaces on what
platforms what works with what so for
example you can see that let's see we
have W LAN down here I'm using Windows
yay
I can use W LAN on Windows so very cool
now that's about it for the graphical
user interface we'll go through more as
we break it down during our different
topics in this Wireshark series but I'll
be right back with a little bit more
options available after the break with
GoToAssist remote support you can
provide live and unattended remote
support to any computer or mobile device
you can screen share with employees to
diagnose and fix their support problems
faster and more effectively and you can
use go to assist apps to deliver support
anytime anywhere from your iPhone your
iPad and even your Android device go to
assist is super super easy to use and it
lets you set up in less than a minute
whether you're supporting one co-worker
10 employees or even a thousand i love
go to assist i've used it here in the
hack shop for tech support with my
co-workers and you can too so sign up
today for 30 day free trial in support
hack tip no contract no credit card
needed visit GoToAssist comm and click
on the try it free button right now and
after your free trial if you purchase go
to assist before october 31st use the
promo code go to assist three zero three
zero to receive thirty percent off the
standard monthly rate that's thirty
percent off with go to assist by citrix
and we thank them for supporting
hack tip we are back with more Wireshark
so let's go ahead and run our first
packet capture I'm going to choose from
mine Wi-Fi since that's what I'm
connected on and I'm going to hit start
and this is going to start giving me a
slew of information so I'm going to go
over here let's click on Facebook and
then I went over here to Twitter and
let's go ahead and let's open up
Pinterest why not okay so now that we
have some information going on on here I
can go ahead and click stop stop is the
little red square up at the top and I
should mention as well there's a little
green triangle right next to that it
kind of looks like a shark fin I guess
and you can hit that if you want to
start up a new capture as well so I've
gone ahead and finished my capture from
here I can go ahead and click file I can
save if I wanted to I can open a new one
if I have one saved already another
interesting thing on here if I go under
here under file is I can print of course
I can quit the program and I can also
export so I can export my entire packet
capture I can export specified captures
if I wanted to of certain packets maybe
if I would just wanted to do TCP packets
or a range of packets so a range of ones
from like the first one all the way to
number 4000 or something I could do that
if I wanted to so it gives you a whole
bunch of different options to be able to
share this information now under edit if
I go under there there we go so I can
find a certain packet if I want to by
clicking find packet I can type in
something like TCP or I could type in I
wonder if there's any UDP packets there
are so I could hit UDP if I wanted to
subscribe what's that so under there I
can find all sorts of different packets
and it'll be divided depending on
whatever I wanted to find now I can also
copy packets I can mark and highlight
any of them the specific packets that I
want to or all of them at once another
interesting thing you can do under edit
as well is reset the time value so if I
go under here I'm just going to scroll
really really far down you'll notice
that you have these time values I
believe these are under seconds so I
have 6 point 1 3 seconds going on
right here if I go under edit I can
click set unset time reference it'll
reset it and give me brand-new time
values starting with that specific
packet that I had clicked on from there
I can also hit mark or unmarked packet
now let's go and highlight it for me so
it highlights it in black and I could
choose to mark all displayed packets so
it marks all of them that I want to see
now I can also hit unmarked all display
packets so it just brings it back to the
normal version I can also ignore a
certain packet if I want to I could go
down here hit timeshift i want to change
mess with the x at all so you can see
that under edit there are a lot of
different customization tools available
to you you can also configure profiles
and preferences so you can do pretty
much whatever you want now that's about
it for today but first I'm going to give
you some homework install Wireshark run
your very first capture and it doesn't
matter what interface you use just pick
one that you're connected to one that
has tons and tons of packets going
through it now look through your packet
capture and see if you can distinguish
between all the different types that
appear not just you know TCP and TLS but
also find what information is stored in
those packets down below see which ones
are encrypted and which ones are
decrypted let me know what you think and
what you find send me a comment below or
you can email us over at tips at hack 5
org and be sure to check out our sister
show hack 5 for more great stuff just
like this and I'll be there of course
reminding you to trust your technology
with no sorting and Storting storks up