Wireshark 101: Downloading; Displaying; and the BPF Syntax! HakTip 117 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by citrix gotoassist the number one
global market leader in remote support
welcome to hack tip the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas
I'm Shannon Morrison today we are
checking out more Wireshark specifically
downloading displaying and the BPF
syntax so first off we had a comment
from our YouTube page from a fan who
said how do i download Wireshark in
Linux now while I'm just simply using an
executable install on my Windows PC we
also walk through a Linux installation
previously on hacked tip 64 I highly
suggest also installing the wind peak
app software that is included with
Wireshark this basically lets Wireshark
put your computer into promiscuous mode
by letting your network card sniff
traffic in promiscuous mode you can not
only see the traffic coming to you but
awesome going to all sorts of targets on
your network now let's take a closer
look at the main window of Wireshark
this week so I'll go ahead and pull it
up in my computer here ok so I've just
gone ahead and done a really really
simple packet capture of my network
nothing too special there I'm not
looking for anything specific but I
wanted to show you all the different
main windows so first up up here at the
very top is the packet list so this is
what you're going to see mainly up at
the top there so you can see everything
that's going on here
ok so first up is this packet list
window up here this is the main window
it's color-coded it's listed by time the
packet is captured as well you'll see
the number of the packet over at the
side so this is going to be the specific
number during the entire packet capture
so since I have mine listed by protocol
at the moment I see 8 to one here and
then 697 however I can switch this to
have numbers first then you see time and
you can change this as well and I'll go
into more information in just a moment
the source so this is where the packet
is coming from the destination where the
packet is going to the protocol for that
specific packet the length of the packet
and more information about that packet
so this can be anything from if there
is passwords and usernames or if there's
a specific image that's being sent
during this packet things of that sort
most of these are pretty
self-explanatory and the next down
underneath that is packet details
listing and this is a whole bunch of
information about a single packet so if
I go into my computer and I click on a
specific packet you'll notice that it
changes down on the packet details
listing so I'll click back and forth on
here and you can see that the
destination is changing at a bunch more
information and if I want to I can go
even more into detail about all the
specific info about each and every bit
of that packet furthermore you can
expand the details pane and you can
click on different parts of the packet
to view details about each and every
segment of that one packet and lastly is
the packet bytes pane so every single
time I click on something in the details
section you'll see that it changes down
here on the packet bytes so these are
the actual little bits of raw data
flying back and forth from the sender to
the receiver so this is what the
computer is seeing all that crazy stuff
at the bottom not a lot is legible
unless there's plain text going on but
that's basically what you're going to
see now you're probably wondering about
the colors on this packet list pane
these are for the different protocols
the cuddler color coding basically just
gives you a really easy way to
differentiate between all the different
protocols or you can also list the pane
by protocol as well now you can change
these as well if you want to by going up
to view and all the way bottom to
coloring rules so I can go here and you
see a lot of information in black
there's ARP is in yellow
ICMP is pink and if I scroll down a
little bit more I see HTTP which you see
back here currently in that light green
color now if I want to I can also edit
each and every one of these I can change
it to be a certain background color so
if I wanted to I could make them a
really hot pink so I'm going to change
that to hot pink now because why not
haha and now I have a completely hot
pink Wireshark because that's really
hardcore now we're going to be right
back with a few more customized
options right after the break with go to
assist remote support you can provide
live and unattended remote support to
any computer or mobile device you can
screen share with employees to diagnose
and fix their support problems faster
and more effectively and you can also
use go to assist apps to deliver support
anytime anywhere no matter where you are
go to assist is easy to set up and it's
easy to use you can actually set up in
less than a minute so sign up today for
GoToAssist and get another Citrix tool
free for six months visit go to assist
comm and get started but don't wait
because this special offer ends October
10th
again that's visit go to assist comm and
sign up to receive this special offer
today and we're back with more
customizing more fun and customizing on
all those different wireshark display so
first off let's dive deeper into time
displays so since time displays are
extremely important whenever you're
trying to analyze an entire network we
also have a whole bunch of options for
viewing timestamps you do have the
option to do the time reference option
now this is over under edit so if I
click on edit I can go to set or unset
time reference and this is what I showed
you previously that it will just change
the time to re F and that will be really
even easy reference for you guys so you
can find that specific packet that
you're looking at you also have the
options under display options to view
different time stamps as well so if you
go to view go down to time display
format there are a ton of options under
here now I prefer the top one the date
and time of day because it's going to
give me not only the date of each and
every capture of each and every packet
but also the hour the minute the second
and the milliseconds of each and every
one now you may be wondering why
milliseconds why does that matter well
packets run through so fast in a few
minutes you could get thousands and
thousands of packets it's really
important to be able to time stamp each
and every one down to the millisecond
now under capture we also have this
thing called interface list so if I go
under here and click on interfaces
showed you a little bit of this
previously but we'll go a little bit D
/ these give you all the different
interfaces you have and then you also
have a whole bunch of different options
now specifically under capture you can
also get to this under options as well
right there so now that I have options
open I can go through here and save my
findings into multiple files depending
on the size or the time of the capture
this is found down here you can click on
use multiple files and then it'll create
a new file every single time I hit one
megabyte one gigabyte that's a huge file
or one kilobyte so if I keep it on one
megabyte and then I can choose to create
a new file every one minute if I have
both of these checked at the same time
it's going to give me the option either
it'll create that file after it hits one
megabyte or it'll create that file after
it hits one minute whichever one comes
first and then I'll just simply turn
that off if I don't plan on using each
of those also under capture there is
this option called filters so I'll go
ahead and close this and show you what
that looks like
capture filters these are going to
filter just those specific packets as
opposed to just capturing every single
thing on the network these capturing
filters can be really useful if you're
looking for specific traffic traffic and
you don't want to deal with all of the
other packets that you can potentially
get on your network another thing that
you should probably know about is BPF
syntax I'll go back under the options
for that under options here we go okay
so you see this thing over here that
says compile selected BPS now that it
doesn't really look like it makes much
sense to be honest but it does so under
the options there's this little button
called compile selected BPS BP f stands
for berkeley packet filter syntax
alright this is the syntax that will
apply to all the filters that you choose
for your capture
so BPF is a syntax used by WinPcap and
is really really important because this
is what's going to make the computer
understand whatever filters that you
make and how those filters are used in
Wireshark if that makes any sort of
sense if BPF filters are called
expressions and expressions have a whole
bunch of different parts called
primitives which basically have a bunch
of parts called qualifiers
now we're going to wait until next
week's really break down what the heck I
just said but remember when we did Linux
terminal commands the whole 101 series
about the Linux terminal and each
command has a syntax that involved a
command an argument and an option so
these expressions are kind of the same
thing you have a whole bunch of
different options and arguments inside
of that one command so I'm going to show
you one of mine one of my expression so
you can kind of see what I'm talking
about here so if we can zoom in up here
at the top you see that I put in a
filter right here
with a whole bunch of different
expressions so this is my BP of syntax
going on this is an expression that
specifically involves a Wi-Fi pineapple
and a phone so if you want to you can go
down to the comments tell me what this
capture is doing down there in the
comments below and I'll let you know if
you're right or if maybe you're on the
right and path you're close but not
quite there so all based on this
expression now let me know of course
what you think below or you can send us
a comment you can email us tips at hak5
org and be sure to check out our sister
show hak5 for more great stuff just like
this I'll be there reminding you to
trust your Titleist