Wireshark 101: Internet Protocol; HakTip 125 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hot tip is brought to you by Full
Sail University
welcome to hot tip the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are checking
out Wireshark and the internet protocol
so last time on the show we discussed
the lower layer protocol called ARP for
address resolution protocol I figured
that we would move on to a few more and
get a better feel of which each and
every protocol does because honestly if
you don't know what a protocol is and
what it does you probably won't fully
understand how to use Wireshark so up
next we have the Internet Protocol now
while ARP is used with MAC addresses to
send data IP handles most of the traffic
for inter Network communication from one
device to another
the Internet Protocol is found on layer
3 of the OSI model which is the network
layer so we had the physical data link
and now we have the network layer now IP
addresses have 32 different bits and
these ID whatever the device is that has
that data the 32 bits are converted into
four sets of ones and zeros which is
then converted into base 10 which pretty
much is where you get like 192.168.1.1
now the number notation that 191 six
eight dot 1.1 the computer registers the
IP address is those 32 bits of ones and
zeros and then we see it as the numbers
that make up an IP address that we
actually understand if we didn't it
would just be 32 ones and zeros and that
would be really hard to memorize now the
first two quarters those first two like
192.168 that usually tells you the
network address and the last two the dot
1.67 or whatever it might be those lists
the host address so whoever is the
actual physical computer now I say
usually because it's not always the
first two that are the network address
these can be determined by looking at a
subnet or network mask if you run across
a net mask of one one one like eight
ones eight ones and then eight zeros
eight zeros that means that the first
two quarters of the network address and
the second two are the actual hosts so
in that case that would
belike 255.255.0.0 now if you don't want
to remember how many bits are supposed
to be the netmask and how many are the
device itself you can look at the
network's cider notation or cidr I say
cider because I really like cider
this stands for classless inter-domain
routing notation now for my local
network it's 192.168.0.1 my local
computer and the net mask of 255.255.0.0
my cider notation would be 192.168.0.1
slash 16 now you might remember that
from hack tip number 92 I believe it was
we showed you how to use cider notation
to scan multiple targets in nmap so this
all stuff always seems to have a way of
coming around full circle
remember cider notations from back then
now you have them again so now you know
how these different IP addresses are
built but let's take a look at Wireshark
well first let's dissect this whole IP
header packet this is very similar to
what you would see with the ARP header
packets but this time we have IP ones so
you may notice when you go down here if
you look at the second window you have a
section called Internet Protocol version
4 has your source up here whatever the
source IP address is and the destination
IP address so you have all that
information right
up at the top now this packet is going
to give you a ton of really good
information including and I'll go ahead
and list through each and every
different version and information on
each and every different line so first
off we had version version is going to
tell you what version of IP is used so
in my case I'm using ipv4 so I see the
number 4 but it could also be ipv6 if
you need next we'll have the header
length and this is going to be 20 bytes
and you'll notice that most of the time
IP is going to be 20 bytes it pretty
much doesn't change down below this
you'll see the type of services that
you're using whatever those might be the
total length of the header and the data
included below that so you'll see total
length equals 40 and then an ID number
to ID the actual packet so in this case
my ID number is 182 for 2 so I know
exactly which packet I'm using now flag
is going to be used if the packet is
part of some larger sequence of packets
so down here you see that it says 0 X 0
to don't fragment that means that there
aren't any other fragments of this
packet I'll do some more information on
fragments in just a little bit so hold
on to that information and going a
little bit further we're going to see
TTL now if you look at TTL it says 1 to
8 so what exactly does that mean
well TTL stands for time to live this
shows you the lifetime of the packet and
hops per second and a little bit more
below this will see protocol so you can
notice that the protocol for this IP
packet is going to be TCP and moving on
from there you'll see a header checksum
for error detection the source IP
address the destination IP address any
extra options and the actual data now
moving on from time to live this tells
you how long a packet is going to be
alive for in transmitting if it ends up
getting stuck in an error a packet could
end up in a never-ending loop and
anybody out there who has done some
programming done some coding or anything
likes like that knows that if you end up
in a never-ending loop that can mean
really bad things for your computer and
for the computing power of it so that's
big no-no you don't want your packets to
end up in a big loop so it's very
important to know how long a packet is
going to go through all the different
routers on the internet before it
actually just goes kaput so in this case
I see 128 that means it's pretty much
you can just assume that's going to be
128 routers before it just dies now I'm
going to show you a little bit more
information about this right after the
break but first it's time to thank our
sponsor as you know virtually every
industry relies on software technology
full sail university located in Winter
Park Florida offers bachelor's degree
programs that address the need for
skilled tech professionals through
curriculum that blends code and theory
with real-world experience offered on
campus the software development
bachelor's degree program teaches
programming fundamentals through
project-based coursework allowing
students to graduate with multiple
completed software products the mobile
development bachelor's degree also
offered on campus but also online
teaches students how to develop apps in
utilities through courses that cover
both ios and android development and the
web design and development bachelor's
degree program also available on campus
and online teaches front-end design
back-end development along with coding
formats programming languages and so
much more all the students have hands-on
access to technology from day one you
get a laptop computer at an
institutional discount along with
relevant software and tools to learn
more about full sales web and Technology
programs visit Full Sail edu slash HACC
tip we are back with more Wireshark and
Internet Protocol packets now let's talk
about this IP fragmentation thing
because it sounds kind of weird right
alright so sometimes an IP packet needs
to be split up into multiple parts to
allow reliable delivery on various
network types this is based on the MTU
m2u or maximum transmission unit size of
the layer 2 protocol whichever one it
ends up being run on so if you're
running on Ethernet for example the MTU
size is 1500 bytes so the IP
fragmentation would occur if the packet
size was over 1500 because you can't fit
more packets into it if Ethernet only
allows you to do 1500 bytes per packet
does that make sense now when you look
at the packet header info for one of
these types of IP packets you'll notice
that under the more fragment section
it'll list how many other packets
include that data so under this one for
example right here you'll see more
fragments is not set in it's set to 0
that means that this packet in
particular has no other fragments that
are along with it now the fragment
offset section will also give you a
number depending on where the packet
falls in the series of fragments so you
could have fragment number 1 number 2
number 3 and so on and how many bytes
are in that packet it might just happen
to be less than 1,500 for the header
length now lastly you'll notice the more
fragment section also says 0 once you
find the last packet in the series so if
this one was part of a much much longer
series of packets this one would still
say 0 at the very end because it's the
last one now I think that about wraps it
up for fragmentation
Internet Protocol I hope that this fully
wraps around everything that you need to
know about IP and I hope that it helped
you understand why in the world all this
information is listed down there let me
know of course what you think send me an
email or comment tips at hak5 org and be
sure to check out our sister show hack 5
for more great stuff just like this I'll
be there reminding you to trust your
Tecna lest packing your pet pack of hit
hippie