Wireshark 101: Name Resolutions and Flow Graphs; HakTip 123 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by hack
5 and viewers like you
support us directly at hack shop calm
welcome to hectic the show will we break
down concepts tools and techniques for
hackers gurus and IT ninjas I'm Shannon
Morse and today we are checking out
Wireshark and name resolutions so let's
talk about these name resolutions this
is basically used in several different
programs to convert one address into
another such as changing a computer's
MAC address into something that makes
sense
such as a DNS or an ARP spelled ARP so
this could be a.com name for example
that would be something understandable
correct
now you can enable these under capture
under options so if I go under capture
and I go to options
I'll have the option under here to
actually change those MAC addresses now
resolving MAC addresses means that
Wireshark will try to resolve the layer
2 or layer 3 MAC address resolving the
network layer names the second option
that you have means that Wireshark will
try to convert something like an IP
address into an easier to interpret DNS
name and then last you have resolved
transport layer names
this means that Wireshark will try to
convert a port number like port 80 into
whatever that port stands for such as
HTTP now keep in mind that name
resolution doesn't always work your
network needs to be set up correctly to
interpret DNS names and these servers
have to be online to work every single
time that you run a capture it also
requires a little bit more power under
the hood as well now here's something
kind of cool that I just found lately
if you go under statistics so I'm going
to close this out and go under
statistics and then there's this thing
called packet links click on packet
links and you'll see a filter option so
I'm going to choose a filter let's
choose TCP only
and then I'm going to go to create stat
and I'll get this nice little graph so
you'll notice under here that most of
the packets are between 1280 and 2559
bytes so if I go under here under 1280
to 25:59 and packet lengths you'll find
that most of my packets five thousand
seven hundred and ninety four of them
are actually between those counts for
that packet size for the bytes now this
usually ends up being some sort of data
whatever kind of data is being
transferred back and forth the second
largest packet length that you'll
usually find is between 40 and 79 and
this pretty much happens with almost
every single capture that you do now
again this is invite so that would be
four thousand five hundred fifty eight
different packets that are between the
byte sizes of 40 and 79 these are most
likely just protocol control commands so
anything that establishes some kind of
connection or some kind of protocol now
I thought it kind of interesting that
most of them are between forty and
seventy nine and that 1280 and 2559 no
matter what kind of capture you do it
just depends on while your countess what
we will change depending on how long
you've let that capture go but for the
most part you'll find that all of your
packet links are between those two
different criteria it's kind of
interesting that all the packets just
end up being those same exact sizes huh
how strange
now right after the break I'll have some
more interesting facts for you including
some feedback we'll be right back
the hack shop is hack 5s premier store
for all of your pen testing needs
including one of my favorites the USB
rubber ducky which looks like a flash
drive and it types like a keyboard it
could type scripts into a computer
ridiculously quickly like this week's
favorite from Peter TFM this script that
he called the uglier old prank creates a
VBS script in the user startup folder
and Auto plays a really annoying video
every single time you want it to if it
can be any YouTube video that you want
so it could be rickrolling or a very
annoying hack 5 episode we couldn't do
the show without your support so we
would like to thank you with something
special of course use the coupon code
snubz with any single order in the hack
shop for your very own signed hacked tip
stickers if you want me to I could even
sign something special just for you
thank you so much for supporting the
show we're back with more fun and
awesome sauce in a Wireshark so first
off I want to take a look at another
graph because I like graphs they're
super handy and there are a lot of
graphs that you can use in Wireshark for
all sorts of different things and this
one is actually pretty cool it's called
the flow graph so you can open this up
by going up to statistics and clicking
on flow graph
and you'll find this if you scroll down
to down down there it is about half way
down and you'll have a couple of
different options so you can pick
options such as do you want to look at
all the packets or just display packets
so if you change to displayed packets
this will just show you whatever you've
displayed under the filter box under
choose flow type you can choose a
general flow or just a TCP flow and then
down under node address type you can
choose a standard source or destination
address as well as network source and
destination address I'm going to leave
these as a default and then move on
so I'll click OK alright so now we have
my graph looks kind of weird so far this
is going to be compiled automatically
you're going to see different time
stamps and then you'll see comments
about each and every single packet and
in the middle under the green area area
is in an analysis of each and every
packet with the source and the
destination so this can help you
visualize each and every packet flow
during your packet capture so for
example if I'm looking for something
specific I can scroll down and down and
down until I'm looking for a specific
time stamp so let's say I wanted to find
something that has to do with a drop box
LAN sink so I'm going to choose this one
and it will automatically change on my
graph below so you'll notice that it
highlights it up at the top
and then I can scroll over and see which
specific IP addresses this is going from
and going to how long it took and
further information in the comments I
think that's pretty cool now for a
little bit of feedback how he says hi I
just recently watched your video
Wireshark 101 downloading displaying and
the BPF syntax so this is hack tip 117
from our YouTube channel and he thought
it was great and he wanted to see more
about beef pieps because he's been
researching them for a while and the
information is somewhat scarce and I
have to agree with you one point he was
a little unclear with with the video was
the capture filters from what he
understands the capture filters are BPS
however the filters section on the main
screen of Wireshark uses display filters
which is a separate filter function the
video made it seem like I would enter a
BP F on the mean screen which I don't
think is the case Howie you are correct
there is a difference and I you're right
I didn't clearly specify between the two
but now I fully understand it I grasped
it a lot better after I've done some
more research so first off BPA filters
so those are a lot different from
display pill filters which of course are
just used to show you a screening of a
specific packet from the whole entire
list that you see in your capture BPF
filters are created before you even
start your capture so you can choose
those in your options before you start
the capture the two are also different
in syntax as well so you can't use a
display filter in the BPF syntax and
vice versa so if you try to put in some
kind of BPF syntax into the filter box
it's not going to work necessarily now I
hope that cleared up some of the
confusion for you
of course let me know what you think as
usual send me a comment below or email
us tips at hak5 org and be sure to check
out our sister show hak5 for more great
stuff just like this I'll be there
reminding you to trust your techno list
bye
you