Wireshark 101: Transmission Control Protocol; HakTip 126 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hot tip is brought to you by Full
Sail University welcome to active the
show will we break down concepts tools
and techniques for hackers gurus and IT
ninjas I'm Shannon Morse and today we
are checking out Wireshark and the
transmission control protocol packets
now today we are breaking down TCP or
transmission control protocol for short
TCP which runs in the layer 4 of the OSI
model and it runs on top of IP so TCP
basically makes sure that your data gets
to where it's supposed to go in a
reliable way so that it doesn't end up
breaking up and destroying your entire
transmission so consider that IP is the
pizza this is going to be a little weird
but following you know IP is the pizza
TCP is the pizza delivery guy or the
delivery girl like me when I worked at
Domino's Pizza and she ensures that your
pizza gets to you on time get it yeah
that kind of makes sense so let's go
ahead and check out a TCP header packet
like the one I have showed up on my
computer now the first part that you're
going to see whenever you find a TCP
header packet is all this information
above you don't really need to pay
attention to the frame 41:21 a thern
ette to Internet Protocol version 4 we
discussed that last week down here under
this next tree is transmission control
protocol so the first thing you're going
to see under here is the source port so
this is going to be used to transmit the
packet and then under that you have the
destination port so for my example my
port is 4 for 3 now this is going to be
the destination which is the port to
where the packet is going to be
transmitted next up you're going to see
a thing called a sequence number and
that's going to be found down here 496
so this is going to be a sequence of the
TCP this is Shores that part of the data
stream isn't missing from the entire
packet it also identifies the TCP
segment now the acknowledgement number
is the sequence number for the next
packet so if I look at mine the
acknowledgement number on this is 4 0 4
3 the relative act number more an axe
and a bit now after that you're going to
see a bunch of different flags
this can include urg for urgent ACH
psh for push rst for reset sin and fin
fin is finished for all the different
types of TCP packets that are available
for it to send from one destination to
another so for example in mine if I
scroll down just a little bit I'll
notice that I have a thin ACK packet
going on here so you're going to see a
bunch of zeros you'll get down here to
ACK acknowledgment and there's a one set
for that so you notice that this is
going to be a packet that includes an
acknowledgment and down at the bottom we
have another one for fin which is set so
that means that it's out there also a
finishing packet now after this we
scroll down a little bit more and we'll
notice something called window size so
this value under here is 255 so the
window size is the size of the TCP
receiver but buffer in bytes not bits
but bytes
now after that you see checksum and
checksum insures the contents are
actually intact and legit so there's
nothing wrong with them and under there
you'll see urgent pointer and this is if
there's an urg flag on the actual packet
so this part is going to give you extra
instructions about where the CPU should
begin reading data in the packet and
other optional info as well now after
the break I'm going to discuss a little
bit more about the different kind of
flags and ports in how you can actually
understand which port a TCP header is
using more after the break
as you know virtually every industry
relies on software technology Full Sail
University located Winter Park Florida
offers bachelor's degree programs that
address the need for skilled tech
professionals through a curriculum that
blends code and theory in real-world
experience offered on campus the
software development bachelor's degree
program teaches programming fundamentals
through project-based coursework
allowing students to graduate with
multiple completed software products the
mobile development bachelor's degree
offered on campus and online teaches
students how to develop apps and
utilities through courses that cover
both iOS and Android development and the
web design and development bachelor's
degree program also available on campus
and online
teaches front-end design back in
development along with coding formats
programming languages and so much more
all students have hands-on access to
technology from day one they receive a
laptop computer at an institutional
discount along with relevant software
and tools to learn more about full sales
web and Technology programs visit Full
Sail zdu / hack tip we're back with
Wireshark and TCP so the transmission
control protocol this works by
transmitting data on ports obviously
because that would make sense which
range between port number 1 and port
number 65535 quartz number 1 through 10
23 are called standard ports so these
are like port 80 for HTTP that falls
within this category and there's several
others but I haven't memorized them all
port 10:24 through 65535 are called
ephemeral ports so these are randomly
selected whenever a device needs to
basically find an open port both the
destination and the client need to know
what port the other one is listening on
to be able to transmit data between them
so you kind of need to know each other's
phone numbers pretty much oftentimes the
source port will be chosen at random
whenever a TCP sends a packet now TCP
TCP packets start with a handshake and
this ensures that the host and the
destination are up and ready to
communicate it checks the open port it
sends a sequence number so that the data
pretty much stays in line now the host
is going to be sending a syn packet to
the destination and then the destination
will send a syn ACK packet so it can
send both flags at the same time and
then the host will send back an ACK or
acknowledged packet right back now
during this handshake the sequence
number will go up by one each and every
time so the first acknowledgment packet
will be numbered you know 45 or whatever
it might end up being the next one after
that would be 46 47 and so on and so
forth and you can have hundreds of
packets between one data transmitted and
the other so lots and lots of packets
going on now the TCP teardown TCP is the
very last packet that's going to happen
this happens between the two devices
before their communication is over and
it's signified by the fin flag okay
that's
very last packet that you'll see because
fin equals finish now the host sends the
destination a fin acknowledge packet and
then the destination sends the host in
AK packet and then a fin ACK and the
host responds with an AK if that makes
sense so let's see if we can find a
teardown packet header in our example on
my computer so if we jump down over here
and I just decided to throw up a whole
bunch up here in the top window so you
can see the differences you can notice
them right here they're already named
for you within Wireshark it makes it
super super easy to find them so you can
see there's a sin there's some acts
there's a sin acknowledge there's a
finish acknowledge so here's a finish
acknowledge okay so when we hit this one
we can see that the source was one eight
nine destination was one thirty we can
go down here and see the acknowledgment
number the header length everything that
you need to see is down here and when we
scroll down a bit we'll find the flags
flag is set to one for acknowledgement
flag is set to one for finish so that is
the very last packet that we'll see in
there and if I scroll down a little bit
more we'll find some other
acknowledgments there's a lot of
acknowledgments going on and I believe
there was an R as t reset one up here
yeah there we go so for this one I will
go ahead and explain that a little bit
now lastly sometimes a TCP packet will
need to send something called a reset or
rst as it would be called in the flag
section now if a connection is halted
all of a sudden by accident the TCP
packet will try to reset this flag all
together and this will halt all traffic
during the sequence and close down the
entire packet so I'll just be like
you're done no more of this talk to the
hand
and it'll completely close it down if I
scroll down a little bit under here
you'll notice that now the flag is set
to acknowledgment and reset so you don't
actually see a finish in this case you
just see a reset now I hope that
explained a lot of what's going on with
transmission control protocol packets
obviously this is the next layer so I'm
hoping to go on and on with
the different layers but of course let
me know what you think if you want to
see me explain more about Wireshark or
if you're pretty much done with it and
you feel like you're an expert now let
me know tips at hack 5 org and be sure
to check out our sister show hack 5 for
more great stuff just like this I'll be
there reminding you to trust your Tecna
less