Wireshark 101: The OSI Model; Hak5 116 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by citrix gotoassist the number one
global market leader in remote support
welcome to hack tip the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are checking
out more Wireshark specifically
understanding protocols and the OSI
model now if you're still wondering why
the heck one would use Wireshark now is
the time to pay attention we're having
some fun with packet sniffing and
analysis but what is that first of all
packet sniffing that's pretty self
descriptive right you're digging under
the applications on your computer your
network you're looking through the
packets that are flowing along your
connection you're analyzing these
packets and that'll help you determine
if there's any kind of problem with the
network that you're on you can check to
see if someone is on your network who
shouldn't be you could figure out what
traffic is making you hit your data cap
for example or you could find out if
some malicious some crazy malicious
thing is going on now Wireshark supports
a whole bunch of protocols when you want
to analyze data such as TCP ARP HTTP DNS
UDP and so many more there's tons
now when capturing all this data
Wireshark makes you go into something
called promiscuous mode it's kind of
like chilling in a dark corner of a
coffee shop and overhearing all the
different conversations around you they
aren't necessarily directed towards you
but since you're in proximity you can
still hear what people are talking about
it's the same with Wireshark it's in
promiscuous mode and it's sniffing it's
listening to everything around it even
if that info isn't directed at you at
your computer with your Wireshark now if
you have ever seen this thing called the
OSI model let's do a graph of the OSI
model it'll give you a really good idea
of how this information in a computer is
transferred and how it's actually seen
by an end user so the OSI model has
seven different layers to it starting
with applications at the very very top
now this is what mom sees when she logs
in to our operating system for example
she just sees the graphical user
interface it's so pretty
now presentation is next in this shows
the computer data in a way that the
applique
can understand such as a JPEG or an mp3
or something like that now third down
this is where you find session session
is going to manage the connection
between two hosted computers and a make
sure that your connection doesn't stop
suddenly transport as the fourth down
and this is where TCP and UDP lives all
those different protocols and it manages
traffic between point a and point B to
make sure that data gets transferred
error-free so everything you send back
and forth is supposed to go just fine
those are the protocols now this is
where things like proxy servers and
firewalls live as well and then there is
Network which is where routers live the
network layer make sure that the routing
of data between two physical points is
also correct six down is datalink and
this operates using mac addresses
bridges and more to identify physical
servers and lastly at the very very
bottom is physical and this is the
actual hardware that data is transferred
through now by understanding that
there's all the different protocols and
how they work on different OSI layers
it'll help you figure out how to fix
problems on your network so we have the
application layer this is HTTP SMTP FTP
telnet then there's presentation that's
ASCII JPEGs mp3s you can also have mpegs
their session would include things like
NetBIOS and s AP transport again that's
TCP UDP things of that nature network is
going to be IP so your internet
protocols data link is going to be like
the Ethernet and physical if you're
using Ethernet that would be your cat5
cable now each layer sits on top of
another to ensure proper delivery of
data from one place to another and if
any of these layers basically fail you
then end up with any kind of errors and
it can be anywhere in any of those
layers by understanding that I can't
browse the Internet if there is any sort
of IP error I know that my network layer
is at fault if I know that everything
works correctly on my end and someone
else isn't receiving my information I
know it is a problem with one of their
OSI layers and we can fix that problem
this is why we have pretty pretty
Wireshark this helps us determine which
protocol is failing what layer
and be able to fix it now after the
break I'll show you how to find the
layers in Wireshark for your capture
with GoToAssist remote support you can
provide live and unattended remote
support to any computer or mobile device
you can screen share with employees to
diagnose and fix their problems faster
and more effectively and you can use go
to assist apps to deliver support
anytime anywhere from your iPhone your
iPad or even your Android device go to
assist is easy to use and it sets up in
less than a minute
whether you're supporting one co-worker
10 employees are even a thousand
I love go to assist I've used it over
here at the hack shop for tech support
with my co-workers and you can too you
can sign up today for a 30-day free
trial and you can support hack tip at
the same time no contract no credit card
needed visit GoToAssist comm and click
on the try it free button right now and
after your free trial if you purchase go
to assist before october 31st use the
promo code go to assist 3030 to receive
30% off the standard monthly rate that's
30% off we've go to assist by citrix and
we thank them for their support of hack
tip we're back with understanding OSI
model layers now that we understand OSI
model layers and which each one includes
let's go ahead and take a look at
Wireshark now I've already done a little
packet capture here on my Wi-Fi with
some really quick internet browsing so
nothing really special we probably won't
find anything super interesting but hey
it's a nice example now everything is
working correctly so no OSI layers are
erroring out if you want to take a look
at the layers in Wireshark though there
is a way you can go to statistics up at
the top and you're going to see this
little thing called protocol hierarchy
so click on that and you'll see this
nice little layout of all these
different protocols so I have Ethernet
in here Internet Protocol data
NetBIOS and I can go ahead and open up
all of these
I am look at them there's so many there
you go I think that's about enough so
this whole list is going to give you
statistics based on the packets and the
bytes transferred at each and every
different stage of the capture first of
all if I go to the top I have protocols
protocols are divided by different type
you can start with the frame which is
going to be your physical layer and then
you can go down to Ethernet and this is
going to be the data link layer that's
interesting who might see OSI isn't that
crazy now from here you can drop down
the Internet Protocol on the network
layer and then I'll have something like
let's see here's TCP down here so that's
going to be on the transport layer and
under there we have SSL in HTTP on the
application layer so SSL is right here
that would be session and if I scroll
down a little bit more yeah there's SSL
there's HTTP the hypertext Transfer
Protocol so that ends up being at the
application letter layer BAM so now you
know exactly how your network is set up
in the form of layers and Wireshark
makes it all super super easy to
understand where all these are mine
completely blown I love this whole OSI
model thing I think it's awesome and it
totally makes sense once you actually
start messing with it I love this now
send me your answers and let me know
what you think you can comment below you
can email us over at tips at hak5 org or
you should just tweet me at snubz i'm on
twitter too now be sure to check out our
sister show hak5 for more great stuff
just like this and I'll be over there
totally geeking out with Wireshark
reminding you to trust your Technol us